Passenger loading event involving Boeing 737-838, VH-XZK, Canberra Airport, Australian Capital Territory, on 1 December 2024

Investigation summary

What happened

On the afternoon of 1 December 2024, a Boeing 737-838, registered VH-XZK, was being operated by Qantas on a scheduled passenger service from Perth, Western Australia, to Sydney, New South Wales. As the aircraft neared Sydney the flight crew were advised that the airport was not accepting arrivals due to storms in the area. The flight crew diverted to Canberra Airport, Australian Capital Territory, with the intention of continuing to Sydney once the airport reopened.

After the aircraft arrived in Canberra, an error was made within the Qantas departure control system that resulted in 51 passengers being incorrectly listed as not on board the aircraft. A loadsheet[1] was created using the incorrect passenger information that contained a weight that was 4,291 kg less than the actual weight of the aircraft. The erroneous loadsheet was issued to the flight crew who used it to make performance calculations for the take-off. The flight crew were not advised of the error until after the aircraft had departed Canberra.

What the ATSB found

The ATSB identified that a minor data input error resulted in an automatic, and undetected, reduction in the number of passengers allocated to the flight. This error cascaded and erroneous passenger information was used by Qantas airport personnel to close the flight, and Qantas load control personnel to create the loadsheet.

Qantas airport personnel had later identified the issue but were unable to rectify the passenger error and did not advise load control. It was also found that although load control personnel held concerns about the validity of the data, and had attempted to understand it, the erroneous loadsheet was issued to the flight crew without resolution. 

The error was identified by load control personnel before the aircraft had departed, and they raised the error with Qantas airport movement control. After that point communication procedures were not followed, and Qantas airport personnel were not successful in communicating the error to the flight crew prior to departure.

What has been done as a result

Qantas has amended its procedures to include a requirement for airport personnel to conduct a headcount when a passenger discrepancy is identified. Qantas has also revised its procedures for communicating critical flight information to flight crew and will implement a new procedure that allows load control personnel to contact flight crew directly via the aircraft communications addressing and reporting system when a loadsheet error is identified. Additionally, local briefings have been issued to Canberra Airport personnel communicating handover requirements, and diversion flight handling scenarios.

Safety message

This occurrence highlights the importance of proactively identifying, addressing, and, when necessary, escalating unusual situations. It is not sufficient to rely on downstream controls or other functions to intervene or trap errors. It also reinforces the value of clear and effective communication with feedback, and adherence to defined procedures.

Demonstrating the value of prudent flight planning, the safety margins built into the performance calculations by the flight crew meant that their reliance on the incorrect data did not lead to an adverse outcome. 

The investigation

The occurrence

Diversion to Canberra

On the afternoon of 1 December 2024, a Boeing 737-838, registered VH-XZK, was being operated by Qantas on a scheduled passenger service from Perth, Western Australia, to Sydney, New South Wales. There were 2 flight crew, 4 cabin crew and 172 passengers on board.

Figure 1: Boeing 737-838 VH-XZK

Source: Victor Pody 

As the aircraft neared Sydney Airport, the flight crew were advised that the airport would not be accepting arrivals for about one hour due to storms in the vicinity. Rather than holding until the storms cleared, the flight crew diverted to Canberra Airport, Australian Capital Territory, with the intention of continuing to Sydney Airport once it reopened. The passengers would remain on board the aircraft in Canberra, and it would be refuelled for the short flight to Sydney.

At about 1516, the aircraft arrived at gate 9 at Canberra Airport. On arrival it was identified that there were 17 passengers whose final destination was Canberra. These passengers were permitted to disembark the aircraft, leaving 155 passengers remaining on board for the flight to Sydney. 

The flight from Canberra to Sydney required the operator to update flight information within their departure control system. That information was to be provided to the flight crew for flight planning. 

Canberra to Sydney flight creation

For the aircraft to continue to Sydney, a customer journey lead (CJL) needed to issue a new flight, known as an ‘addstop’, for the Canberra to Sydney sector in the Altéa Inventory (inventory) system[2] (see Departure control system and Customer journey management). 

When issuing the addstop for the flight, the CJL identified that it did not have an assigned aircraft configuration code. As a result, they looked up the code for the Boeing 737, which was 73RA01, but they inadvertently entered the code for the Boeing 717, which was 71RA01, and committed (locked) the flight. The Boeing 737 had a maximum seating capacity of 176 passengers, which was composed of 12 business seats and 164 economy seats, and the Boeing 717 had a maximum seating capacity of 125 passengers with no business seating. 

There were 11 business and 161 economy passengers on board the aircraft when it arrived in Canberra. When the CJL committed the flight with the incorrect configuration code, the system automatically offloaded[3] all 11 business class passengers and placed between 40 and 57 passengers[4] on standby[5] due to the reduced capacity of the Boeing 717.

The CJL recalled that they knew the Boeing 737 was the correct aircraft for the flight, and the incorrect code was the result of a typing error. They also recalled experiencing a high workload at the time due to an unusually large number of diversions and they felt pressure to complete the addstop ‘as quickly as possible’. 

Prior to committing the flight, the system would have presented the CJL with a dialogue box, caused by the Boeing 717 not having business seating, that required them to check and acknowledge the change (Figure 2). While the CJL recalled that the inventory system would present a number of automated pop-ups that needed to be accepted, they did not specifically recount sighting or accepting the class matching dialogue box. 

Figure 2: Amadeus Altea Inventory system class change dialogue box

Source: Qantas

The CJL identified the aircraft configuration code error almost immediately after committing the change, and they escalated the matter to their manager, and then to the load control systems manager (LCSM) to unlock the flight. The LCSM was the only person within the organisation who held the necessary permissions to unlock the inventory system.

At about 1526, the CJL contacted the LCSM and requested assistance to unlock the system so that the correct aircraft configuration code could be entered. The CJL contacted the LCSM again at about 1532. The LCSM was off duty at the time and away from their home. The LCSM returned home and unlocked the system using their laptop. 

The CJL corrected the aircraft configuration code for a Boeing 737 and re-committed the flight. However, the CJL had not realised that  the inventory system had automatically offloaded some passengers from the flight and placed others on standby due to the reduced passenger capacity of the Boeing 717 (see Customer journey management). 

Canberra Airport activities

The Qantas airport duty manager (ADM), who was overseeing the ground activities for the aircraft in Canberra, noticed that the new addstop flight to Sydney was unusually slow to show in the Altéa Customer Management (CM) system (see Departure control system). Between 1519 and 1600, the ADM attempted to establish the status of the addstop by calling the CJL, the load control operations leader (LOCO), and the integrated operations centre (IOC) and was advised that there was an issue with the flight in the system. 

At about 1632, the ADM was advised by the IOC that the issue had been partially resolved. Once the Canberra to Sydney addstop flight became available to the ADM in the CM system, they made adjustments to reflect the offloaded 17 passengers who were disembarking the aircraft in Canberra, all of whom had occupied an economy seat. The ADM then undertook a ‘mass boarding’[6] of the remaining passengers, in accordance with Qantas procedures, and closed the flight. At about 1646, the ADM issued the ‘passenger clearance’ for the flight and the ‘ramp clearance’ was issued at about the same time (see Ramp and passenger clearance). 

A short time later, an airport customer service agent (CSA 1) advised the ADM that there were passengers listed as standby for the flight. The ADM recalled that it was unusual for a diversion flight to have standby passengers and they were not aware of this when they closed the flight. At that time, 11 passengers had been offloaded, and 40 were listed as standby, resulting in a total of 51 passengers not recorded as on board the aircraft when the flight was closed.

The ADM recalled attempting to onboard the standby passengers within the CM system but was not successful. They recalled assuming the problem was related to the earlier issues with the addstop flight. They also recalled thinking that load control would already be aware of the issue, based on earlier telephone conversations with the LOCO where they had discussed the number of disembarking passengers, and that they would be able to rectify the problem prior to issuing the loadsheet. The ADM did not contact the LOCO.

Load control activities

The LOCO commenced the creation of the addstop loadsheet within the Altéa Flight Management (FM) system once the correct aircraft configuration code had been entered by the CJL (see Departure control system). At that time, the LOCO was in contact with the LCSM by telephone and they soon identified that the incorrect code had caused changes to be made to the loading documentation for the aircraft. This had resulted in a significant discrepancy between the number of passengers on board the flight from Perth and the number of passengers on the addstop flight to Sydney. 

Over a period of about 35 minutes, both the LOCO and the LCSM attempted to understand the information. This included contacting the Canberra ADM to confirm the number of passengers that had disembarked the aircraft as well as the fuel usage for the previous flight. The LOCO recalled they did not understand the issue or how to resolve the discrepancy and discussed the matter with the LCSM. They recalled the LCSM advised them to go with the passenger figure within the system as it had been confirmed by Qantas airport personnel. 

At about 1702, the LOCO issued the flight crew the provisional loadsheet and the final loadsheet for the flight simultaneously despite having ongoing concerns about the validity of the information (see Loadsheet). About one minute later the LCSM, who was still examining the loading information for the flight, identified the standby passengers within the system and advised the LOCO of the error.

Communication of loadsheet error

The LOCO initially attempted to contact the captain by mobile phone to inform them of the loadsheet error, but the call went unanswered. At about 1704, the LOCO contacted the Canberra airport movement control officer (MOCO) and advised them that the loadsheet was incorrect and the aircraft was not to depart (see Load control loadsheet error communication procedures).

The MOCO recalled that they attempted to contact the flight crew via radio, but they did not receive a response. The captain recalled they turned off the company frequency on receipt of the final loadsheet to reduce distractions while they entered the data and generated the take-off speeds. 

The MOCO then radioed a customer service agent (CSA 2), who was at the aircraft door with the flight’s customer service manager (CSM) at the time. The CSA 2 recalled discussing the loadsheet with the CSM, and they believed the CSM had also overheard the radio communications about the matter. The CSA 2 also recalled seeing the CSM enter the flight deck shortly after the discussion and believed the message had been passed to the flight crew. 

A short time later the CSM advised the CSA 2 that the doors could be closed, and the aircraft would be departing. However, the CSM reported that they did not receive a message from the CSA 2 about the loadsheet and, as a result, had not advised the flight crew of an error.

At about 1705, after providing instructions to the CSA 2 to contact the crew, the MOCO went on a scheduled break when advised to do so by the ADM. No handover was completed prior to the MOCO going on break as they believed the ADM was already aware of the loadsheet issue. However, the ADM recalled they had no awareness of the error at that time. 

Aircraft departure 

The error in the final loadsheet resulted in a calculated weight that was 4,291 kg less than the actual weight of the aircraft. The flight crew used this erroneous weight to make performance calculations for the take-off (see Loadsheet error and performance implications). 

The captain noted that the passenger figure within the loadsheet had reduced from the flight from Perth, but recalled that the CSM had made them aware that some passengers would be leaving the aircraft as their final destination was Canberra. They also recalled observing a line of people departing the aircraft. On receipt of the final loadsheet, the captain believed the reduced passenger figure reflected the number of people that had left the aircraft. Other than the passenger figure within the loadsheet, the flight crew were not advised of the final number of passengers that had disembarked the aircraft, nor was there a procedural requirement to do so.   

At 1712 the aircraft doors were closed. At 1714, the aircraft pushed back from gate 9 and it became airborne at about 1721. The captain recalled that during the take-off the aircraft was slightly slow to accelerate but they did not experience any controllability issues.

At 1737, when the aircraft was in cruise at 15,000 ft, the flight crew received an aircraft communications addressing and reporting system (ACARS)[7] message that load control were working to correct the loadsheet. On receipt of the ACARS message, the flight crew radioed the port controller and were advised that the loadsheet that had been issued to them contained an incorrect passenger figure. The flight crew placed the aircraft in a hold[8] while the correct weights were established. The aircraft later landed at Sydney Airport without further incident. 

Context

Departure control system

Qantas utilised the Amadeus Altéa Departure Control information technology system to manage operational activities. The system was composed of various integrated components including:

• Altéa Inventory (inventory) – which was used to manage flight schedules, passenger seating and flight disruptions.
• Altéa Customer Management (CM) – which was used to carry out the management of customers including monitoring cabin seating configurations, boarding activities, baggage, and acceptance figures.
• Altéa Flight Management (FM) – which was used to perform load control functions for aircraft and create the necessary documents for flight.

Customer journey management

Qantas customer journey personnel were responsible for the issuance of a new flight following a diversion to an alternate airport. These new flights, called ‘addstops’, were managed within the inventory system.

When issuing a new addstop flight, customer journey personnel would make manual amendments as required, including adding or changing the aircraft configuration code. If a change was made that resulted in the allocation of an aircraft with a smaller seating capacity than the original aircraft, it would cause the system to automatically either offload or place on standby the excess number of passengers. While the offloading of passengers was an automatic function, any further amendment to an aircraft with a larger capacity required the user to manually transfer the passengers back onto the flight.

Airport passenger management

Qantas airport personnel were responsible for the arrival and dispatch of the diversion flight, including oversight of the refuelling and passenger management. During this process, airport personnel utilised the CM system to manage passenger information. In normal circumstances, as passengers boarded a Qantas aircraft, their boarding passes were scanned, and the CM system was updated automatically with passenger boarding information. However, as this was a diversion flight which involved the majority of the passengers remaining on board, airport personnel were required to manually update this information within the CM system.

Loadsheet

General

A loadsheet is a document created for each flight that contains details such as the quantity and distribution of fuel, cargo, baggage, crew and passengers on board the aircraft. It is used to calculate aircraft weight and balance parameters, and performance requirements. Load control personnel were responsible for the creation of loadsheets using the FM system.

A provisional and a final loadsheet were required to be created for all flights. The provisional loadsheet detailed the anticipated configuration of the aircraft. The final loadsheet contained the confirmed aircraft configuration and could only be issued after the passenger and ramp clearances were received from the departure airport personnel.  

Ramp and passenger clearance

Ramp clearance was a report issued by the airport loading supervisor[9] to load control personnel indicating the completion of loading, including final baggage numbers. The data contained within the ramp clearance was then used for loadsheet computation.

Passenger clearance was a report issued by departure airport personnel to load control personnel indicating that no further passengers were to be accepted for the flight, with the majority of passengers on board and the remaining passengers’ exact location known.  

Communication of loadsheet errors

Load control loadsheet error communication procedures

In scenarios where an error was identified in the final loadsheet after it had been issued to the flight crew, but before the aircraft had departed from the gate, the Qantas Weight and Balance Manual required the load control operations leader (LOCO) to contact the movement control officer (MOCO) in Canberra and for them to notify the flight crew of the nature of the discrepancy.

Airport communication procedures

The procedures to be used by Qantas airport personnel to contact the flight crew prior to an aircraft having departed the gate were documented in the Qantas Canberra Airport Movement Control Operating & Training Manual (version 1.2 dated September 2024). That stated:

Contacting a [flight] crew is to be done via ground to air radio in the first instance.

If contact is not made, then an agent is sent to ask the crew to contact MOCO.

If agent is unable (due door closed/aerobridge disconnected), engineer/pushback on headset to request crew contact MOCO.

Flight crew communication procedures

The procedures to be used by flight crew when maintaining radio communications with the airport personnel were contained in the Qantas Flight Administration Manual (dated 1 August 2024) which stated:

Subject to operational requirements, flight crew should maintain a listening watch on company frequency and interphone during transit.

It also stated:

For domestic operations, the frequency for the [port controller] must be monitored from [estimated time of departure]-5 minutes until pushback commences. 

Loadsheet error and performance implications

Loadsheet information

The passenger composition and aircraft zero fuel weight (ZFW)[10] as documented in the loadsheet for the previous flight, and the erroneous and corrected loadsheet for the incident flight are contained in Table 1. 

Table 1: Loadsheet information

Loadsheet error

The erroneous loadsheet issued to the flight crew listed the total number of passengers on board the aircraft as 104, whereas the actual number of passengers on board was 155. This resulted in a ZFW of 55,539 kg when the actual ZFW of the aircraft was 59,830 kg.

The Qantas Flight Administration Manual contained a caution note to flight crew that stated:

Following a diversion the ZFW and passenger numbers on the loadsheet for the subsequent sector must be reconciled against those for the preceding sector. The new ZFW should be the same unless passengers disembark or pantry is changed.

For a change in passenger load allow 100 kg per passenger when reconciling ZFW values. e.g. if 20 pax disembark the new ZFW should be approximately 2,000 kg less than previous.

The error within the loadsheet resulted in a ZFW difference between the subsequent and preceding sectors of 5,725 kg, with 68 passengers captured as having disembarked the aircraft. This reduction in weight was more conservative than the formula contained within the Qantas Flight Administration Manual, which equated to about 6,800 kg. While the captain recalled being aware of the reduced passenger figure, they did not recount having undertaken the ZFW reconciliation calculation.

Performance implications

The flight crew used the incorrect loadsheet to calculate aircraft performance. This resulted in the generation of take-off speeds 3–4 kt less than those applicable to the aircraft’s actual weight. This increased the risk of degraded performance and unanticipated handling characteristics during the take-off. However, the flight crew elected to use the full length of the runway for the take-off, and did not apply the headwind component, which added an increased safety margin for take-off performance.

Independent passenger number verification

The Qantas Cabin Crew Operations Manual (dated 1 October 2024) contained a process for an independent verification of passengers on board an aircraft. It stated:

Security requires that where positive accountability of passengers is not possible during boarding, the number of passengers must be verified by a headcount prior to departure. The headcount is to ensure that the correct number of passengers have entered the aircraft, via the tarmac.

However, the process was not required for scenarios involving the partial disembarkation at a diversion airport.

Related occurrences

Aircraft loading and confirmation processes involve a number of people fulfilling different functions. Errors can be introduced at any point and carried through various interfaces.

At Sydney Airport in 2017, an Airbus A330 departed overweight after a required cargo variation was not actioned by ground crew (ATSB investigation AO-2018-003). A decision by the flight crew to carry additional fuel led to a requirement to reduce the weight of freight on board the aircraft. A 2,005 kg freight pallet was to be replaced with a lighter unit weighing 1,130 kg. The cargo variation was not actioned by the loading supervisor as electronic messages associated with the revised loading instruction were acknowledged without being correctly interpreted. That was probably influenced by the supervisor’s experience that load changes were accompanied by verbal advice, and that did not occur on this occasion.

In the East Midlands, UK, in 2023 a Boeing 737 tail strike resulted from the provision of 2 different load data sheets (AAIB investigation AAIB-29762). One was correct and the other, a remnant from the previous flight, was incorrect for the next flight. The incorrect data was used for performance calculations, and the aircraft weight was calculated to be around 10,000 kg lighter than the actual weight. This led to the take-off being 15 kt too slow on rotation and the tail struck the ground.

Five passenger loading events that occurred in Australia over the period 2015–2017 were investigated (ATSB investigation AI-2015-139). On these five separate occasions the aircraft were loaded with incorrect passenger distributions or with incorrect passenger numbers used to determine the aircraft's weight and balance. This placed increased operational pressure on flight and cabin crews and, on at least one occasion, adversely affected aircraft performance during take-off. 

Safety analysis

Incorrect aircraft configuration code 

The customer journey lead (CJL) entered the incorrect aircraft configuration code when creating the ‘addstop’ flight for the Canberra to Sydney sector. This error was consistent with a skill-based ‘slip’, where an individual’s intentions are correct, but the action is incorrectly completed (Tsang and Vidulich 2003). In this case, the CJL entered one incorrect digit. 

The CJL also described a high workload environment at the time due to the number of diverted flights, and that they felt a time pressure to complete the addstop task. According to Orlady and Orlady 1999, workload within the aviation environment can be considered as ‘reflecting the interaction between a specific individual and the demands imposed by a particular task. It represents the cost incurred by the human operator in achieving a particular level of performance’. Increases in workload during abnormal situations have been linked to an increase in error rates in individuals (Johannsen and Rouse 1983). Consequently, it is possible that the CJL’s input error was influenced by the increased workload they were experiencing at the time.

The CJL committed the flight in the Altéa Inventory system prior to identifying the error. When doing so, the CJL would have been presented with a pop-up that highlighted the business class seating issues. However, they did not specifically recount sighting or acknowledging the pop-up. This was probably due to ‘expectation bias’ which involves an individual observing what they expected to occur, rather than what actually occurred (Flight Safety Foundation 2014). It is therefore likely that the CJL acknowledged the pop‑up, without considering the contents of the message, due to their expectation that the flight information was correct.

Having later identified and corrected the aircraft configuration code, the CJL did not identify that the system had made automatic changes to the passenger composition of the flight. This was also likely due to expectation bias as the CJL believed the correction had fully addressed the issue. Consequently, some passengers who were on board the aircraft were offloaded, or listed as standby, and not reallocated to the flight.

Flight closed with incorrect passenger data

The Qantas airport duty manager (ADM) at Canberra closed the flight without identifying the 51 offloaded and standby passengers. As a result, these passengers were recorded as not being on board the aircraft. The ADM recalled that it was unusual for standby passengers to be listed for a diversion flight, and they did not see them within the Altéa Customer Management (CM) system. The ADM’s recollections were consistent with expectation bias, where the ADM’s prior experience with diversion flights influenced their ability to identify the unusual scenario.

Having closed the flight, the ADM was made aware of the standby passengers by a customer service agent. The ADM attempted to onboard these passengers within the CM system, but when this proved unsuccessful the ADM took no further action to address the issue. The ADM recalled assuming the standby passenger issue was a manifestation of the earlier problems with the addstop flight, and that load control were aware of the issue and would resolve it prior to publishing the loadsheet. As a result, they did not consider communicating the matter to load control.

Erroneous loadsheet issued

The load controller’s (LOCO) decision to issue the loadsheet to the flight crew, despite having ongoing concerns about the validity of the information, was likely influenced by several factors including the closure of the flight and issuance of the passenger clearance by the ADM. In accordance with Qantas procedures, the ADM’s passenger clearance confirmed to the LOCO that the number of people listed as on board the aircraft in the Altéa Flight Management (FM) system, was correct. However, as stated above, the ADM had later become aware that there were additional passengers listed as standby for the flight but did not communicate this information to the LOCO.

The LOCO had also exhausted their ability to identify the reason for the anomalies and resolve the issue, and they communicated their concerns to the load control system manager (LCSM). In response, the LCSM advised the LOCO to issue the loadsheet using the information within the FM system, which the LOCO then did. It is possible this outcome was a result of a phenomenon known as ‘risky shift’. Risky shift means it is easier for a group to make a decision involving a greater acceptance of risk than an individual would on their own due to a variety of factors including the diffusion of responsibility (Smith and Radinsky 1970).

The result was the provision of an erroneous loadsheet to the flight crew that contained a weight that was 4,291 kg less than the actual weight of the aircraft. Shortly after the loadsheet was issued to the flight crew, but before the aircraft had departed, the LCSM identified the standby passengers within the FM system and advised the LOCO.

Communication of loadsheet error

Once the LOCO was made aware of the error within the loadsheet, they took immediate action to inform the flight crew of the issue. When the captain did not answer their mobile telephone, the LOCO communicated the error to the airport movement control officer (MOCO) in accordance with Qantas procedures. Having done so, it was reasonable for the LOCO to believe the flight crew would be informed of the error and the aircraft would not be permitted to depart. 

On receipt of the information from the LOCO, the MOCO attempted to contact the flight crew via radio, but they had deselected the company frequency. This took place about 10 minutes prior to pushback at a time when Qantas procedures required the flight crew to maintain a listening watch on the company frequency, subject to operational requirements. The captain recalled that the radio was deselected to reduce distractions while they entered the loadsheet data and generated the take-off speeds. This reason for deselecting the company frequency was likely consistent with the ‘operational requirement’ caveat of the procedures. However, it limited the ability of Qantas airport personnel to communicate directly with the flight crew in the lead up to departure.

Having been unable to contact the flight crew via radio, the MOCO radioed the customer service agent (CSA 2) and instructed them to inform the flight crew that the loadsheet contained an error. This did not conform with Qantas procedures which required the flight crew to be instructed to contact the MOCO and communicate directly with them. Doing so would have ensured that the flight crew received the information and closed the communication loop with the MOCO.

The CSA 2 did not inform the flight crew. The CSA 2 reported that at the time the MOCO contacted them by radio the CSA 2 was with the customer service manager (CSM) at the aircraft door. The CSA 2 believed the CSM overheard the MOCO’s radio call and that the CSM would tell the flight crew. 

However, The CSM could not recall either being advised of a loadsheet error or overhearing the radio communications about the matter. It is likely that the CSM would have advised the flight crew had they heard of the problem. The flight crew were not informed of the loadsheet error.

While the procedure was for the MOCO to request direct communication from the flight crew, shortly after divesting responsibility to the CSA 2, the MOCO went on break as instructed by the ADM. No one was allocated the responsibility of ensuring resolution prior to departure as the MOCO believed the ADM was already aware of the loadsheet issue. However, the ADM reported they had no awareness of the error at that time. The MOCO did not return from break until after the aircraft had departed. 

The procedural and communication breakdown meant that while Qantas’ airport personnel were aware of problems with the loadsheet, no-one communicated directly with the flight crew or made certain that the flight crew understood that there was a problem. As a result, the aircraft departed with 4,291 kg more weight than anticipated by the flight crew. The flight crew’s prudence in applying safety margins to their departure profile avoided adverse outcomes for the flight. 

Independent process to confirm actual number of passengers on board aircraft

Qantas did not have an independent process to confirm the actual number of passengers on board an aircraft following partial disembarkation at a diversion airport. In these scenarios the final passenger figure within the loadsheet relied exclusively on the accuracy of the transposed data from the previous flight and any manual amendments made by Qantas airport personnel. Other than the figure within the loadsheet, Qantas had no other mechanism to advise the flight crew of the number of passengers that had disembarked the aircraft. Consequently, the absence of an independent process to confirm the actual number of passengers on the aircraft, such as a headcount, could limit a flight crew’s ability to verify the information contained within a final loadsheet and identify any passenger number error.

Findings

From the evidence available, the following findings are made with respect to the passenger loading event involving Boeing 737-838, VH-XZK, Canberra Airport, Australian Capital Territory, on 1 December 2024.

Contributing factors

• After correcting a minor data input error, the customer journey department did not notice that an automatic reduction in the number of passengers allocated to the flight had occurred. As a result, some passengers who were on board the aircraft were not reallocated to the flight.
• Although Qantas load control personnel held concerns about the validity of the data, and had attempted to understand it, the concerns were not resolved and the erroneous loadsheet was issued to the flight crew. The error was identified by load control after it had been provided to the flight crew, but before the aircraft had departed.
• Qantas airport personnel inadvertently used the erroneous passenger data within the scheduling information to close the flight. The issue was identified after the flight was closed, but the airport personnel did not ensure Qantas load control were aware of the matter.
• The flight crew were not informed of the identified loadsheet error before the aircraft departed. This was due to:
  • the flight crew had deselected the ground communication frequency and were therefore not contactable by radio
  • after instructing the customer service agent to contact the flight crew in person, there was no further follow-up or communication with the flight crew made by the movement controller
  • the customer service agent was not instructed to advise the flight crew to contact the movement controller via radio when attempting to pass the information on in person
  • the customer service agent understood that they had informed the cabin crew of the loadsheet error, and believed they would inform the flight crew.

Other factors that increased risk

• Qantas did not have an independent process to confirm the actual number of passengers on board an aircraft following partial disembarkation at a diversion airport. This could limit a flight crew’s ability to verify the information contained within a final loadsheet and identify any passenger number error.

Safety actions

Safety action by Qantas

The Qantas load control diversion checklist has been amended to include a requirement for airport personnel to conduct a headcount when a passenger discrepancy is identified. 

The Qantas airport product and service manual has been amended to contain a procedure for scenarios where critical flight information needs to be communicated to the flight crew, but they are uncontactable. This includes contacting air traffic control to prevent the aircraft from departing and requiring closed loop communications to confirm receipt of critical information. Qantas will also implement a procedure that allows load control personnel to contact flight crew directly via the aircraft communications addressing and reporting system when a loadsheet error is identified.

A local brief was issued to Canberra Airport personnel that defined the requirements for a handover, when going on break, to ensure critical information is communicated. A local brief was also issued that outlined the requirements for handling an inbound diversion, including ‘all possible scenarios regarding passengers disembarking/remaining onboard’. 

Sources and submissions

Sources of information

The sources of information used during the investigation included:

• Qantas
• captain and first officer
• customer service manager
• airport duty manager
• customer service agent
• officer movement control
• load control operations leader
• customer journey lead
• load control systems manager
• Bureau of Meteorology

References

Flight Safety Foundation. (2014). A practical guide for improving flight path monitoring, final report of the active pilot monitoring working group. Available from https://flightsafety.org.

Johannsen, G. and Rouse, W. (1983). Studies of planning behavior of aircraft pilots in normal, abnormal, and emergency situations. Systems, Man and Cybernetics, IEEE Transactions on, (3), pp.267-278.

Orlady, H. and Orlady, L. (1999). Human factors in multi-crew flight operations. Ashgate, Aldershot, UK p.203. 

Smith, G. and Radinsky, T. (1970). The Effect of Diffusion and Concentration of Responsibility on the Risky Shift Phenomenon in a Two-choice Situation. Proceedings of the Iowa Academy of Science, 77(1), 308-314.

Tsang, O. and Vidulich, M. (2003). Principles and practice of aviation psychology. Lawrence Erlbaum Associates, Mahwah, New Jersey.

Wickens, C. Hollands, J. Banbury, S. & Parasuraman, R. (2013). Engineering psychology and human performance (4th edition). Pearson, Boston.

Submissions

Under section 26 of the Transport Safety Investigation Act 2003, the ATSB may provide a draft report, on a confidential basis, to any person whom the ATSB considers appropriate. That section allows a person receiving a draft report to make submissions to the ATSB about the draft report. 

A draft of this report was provided to the following directly involved parties:

• Qantas
• captain and first officer
• customer service manager
• Canberra Airport duty manager
• Canberra Airport customer service agent
• Canberra Airport officer movement control
• load control operations leader
• customer journey lead
• load control systems manager
• Civil Aviation Safety Authority 

Submissions were received from:

• Qantas
• Civil Aviation Safety Authority
• load control operations leader
• Canberra Airport officer movement control.

The submissions were reviewed and, where considered appropriate, the text of the report was amended accordingly.

Purpose of safety investigations The objective of a safety investigation is to enhance transport safety. This is done through:  identifying safety issues and facilitating safety action to address those issues providing information about occurrences and their associated safety factors to facilitate learning within the transport industry. It is not a function of the ATSB to apportion blame or provide a means for determining liability. At the same time, an investigation report must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. The ATSB does not investigate for the purpose of taking administrative, regulatory or criminal action. About ATSB reports ATSB investigation reports are organised with regard to international standards or instruments, as applicable, and with ATSB procedures and guidelines. Reports must include factual material of sufficient weight to support the analysis and findings. At all times the ATSB endeavours to balance the use of material that could imply adverse comment with the need to properly explain what happened, and why, in a fair and unbiased manner. An explanation of terminology used in ATSB investigation reports is available here. This includes terms such as occurrence, contributing factor, other factor that increased risk, and safety issue. Publishing information Released in accordance with section 25 of the Transport Safety Investigation Act 2003 Published by: Australian Transport Safety Bureau © Commonwealth of Australia 2025   Ownership of intellectual property rights in this publication Unless otherwise noted, copyright (and any other intellectual property rights, if any) in this report publication is owned by the Commonwealth of Australia. Creative Commons licence With the exception of the Commonwealth Coat of Arms, ATSB logo, and photos and graphics in which a third party holds copyright, this report is licensed under a Creative Commons Attribution 4.0 International licence. The CC BY 4.0 licence enables you to distribute, remix, adapt, and build upon our material in any medium or format, so long as attribution is given to the Australian Transport Safety Bureau.  Copyright in material obtained from other agencies, private individuals or organisations, belongs to those agencies, individuals or organisations. Where you wish to use their material, you will need to contact them directly.