Nothing in this document matches .
Impact
On Wednesday 9 September, the Gannet’s 07:40 to Holm had 53 cars booked for 42 spaces. Crew caught it at the ramp check at 06:12. Every driver crossed that morning: 42 on the 07:40, and the 11 who booked last on a relief sailing at 09:10.
Two drivers missed the start of their shifts on Holm, and the harbour office took 64 calls before 09:00.
Timeline
- Tue 20:04The 07:40 sells its last car space
Online sales reach 42 of 42 cars, and the app shows the deck as full.
- Tue 20:31The harbour office terminal reconnects
After a restart for an update, the terminal replays eleven car holds it had kept offline since the afternoon. The booking service accepts all eleven.
- Wed 06:12Crew count 53 cars booked for 42 spaces
The ramp check at Varre compares the loading list with the deck plan, and it does not add up.
- Wed 06:20Incident declared at SEV-2
Joss is paged and joins from home. Ines takes the office phones.
- Wed 06:48A relief sailing is agreed for 09:10
The Gannet’s master agrees a second crossing, and the office texts the eleven drivers who booked last.
- Wed 07:40The Gannet sails full
- Wed 08:17Every moved driver refunded
Eleven refunds and free returns go out, and offline holds are switched off on the terminal.
- Wed 09:10The relief sailing leaves with all eleven cars
Contributing factors
Offline holds were replayed without a capacity check The terminal's replay path writes holds straight to the bookings table, past the check every other sale goes through.
The terminal's replay path writes holds straight to the bookings table, past the check every other sale goes through.
- Evidence
The booking log has eleven
hold.replayevents between 20:31:07 and 20:31:09, and none of them has acapacity.checkspan.
Nothing alerts when a sailing sells past capacity The oversale was in the data from 20:31, and nobody saw it for ten hours.
The oversale was in the data from 20:31, and nobody saw it for ten hours.
- Evidence
The capacity dashboard showed 53 of 42 all night. Its alerts only cover payment failures.
The terminal had held those eleven places since 14:05, and would have replayed them days later.
Follow-ups
At a glance6 follow-ups
| # | Follow-up | Category | Owner | Effort | Impact | Verdict |
|---|---|---|---|---|---|---|
| 1 | Alert when any sailing sells past capacity | detect | Joss | S | ||
| 2 | Show cars sold against spaces on the loading list | detect | Mira | S | ||
| 3 | A runbook for an overbooked sailing | mitigate | Ines | S | ||
| 4 | Tell the last drivers before they set off | mitigate | Tomas | M | ||
| 5 | Check capacity when the terminal replays holds | prevent | Tomas | M | ||
| 6 | Expire offline holds after ten minutes | prevent | Mira | S |
Effort is agent time, not calendar time: S is under an hour, M is a few hours with review, L is a day or more across sessions.
1Alert when any sailing sells past capacity
A check every minute pages whoever is on call when bookings exceed spaces on any sailing.
Alert when any sailing sells past capacity
A check every minute pages whoever is on call when bookings exceed spaces on any sailing.
- Addresses
Nothing alerts when a sailing sells past capacity, and ten hours passed between the double sale and the ramp check.
- What changes
A query compares bookings with deck spaces for every sailing in the next 72 hours, once a minute, and pages on any excess.
- Done when
Replaying the 9 September data in staging pages within two minutes.
2Show cars sold against spaces on the loading list
The crew's loading list opens with cars sold against spaces, in ochre when they do not fit.
Show cars sold against spaces on the loading list
The crew's loading list opens with cars sold against spaces, in ochre when they do not fit.
- Addresses
Crew found the problem at 06:12 by counting the list against the deck plan.
- What changes
The list header shows the count, such as 53 of 42, and marks each car sold after the deck was full.
- Note
Shipped on 11 September in crew app 2.8.1.
3A runbook for an overbooked sailing
One page on who to call, how to arrange a relief sailing, and what to offer the drivers moved.
A runbook for an overbooked sailing
One page on who to call, how to arrange a relief sailing, and what to offer the drivers moved.
- Addresses
The 28 minutes from 06:20 to 06:48, spent finding out who could approve a relief sailing.
- What changes
A page in the office handbook with the masters’ numbers, the relief sailing checklist, and the standard offer of a refund and a free return.
4Tell the last drivers before they set off
When a sailing is oversold, the drivers who booked last get a message and a held place on the next sailing.
Tell the last drivers before they set off
When a sailing is oversold, the drivers who booked last get a message and a held place on the next sailing.
- Addresses
Eleven drivers learned at the ramp, some after a long drive to Varre.
- What changes
The oversale alert messages each driver past capacity, in booking order, with a held place on the next sailing and a free cancellation.
- Done when
In staging, an oversold sailing sends every message within five minutes of the alert.
5Check capacity when the terminal replays holds
Replayed holds go through the same capacity check as every other sale, and fail in plain sight when a deck is full.
Check capacity when the terminal replays holds
Replayed holds go through the same capacity check as every other sale, and fail in plain sight when a deck is full.
- Addresses
Offline holds were replayed without a capacity check.
- What changes
The replay path calls
booking.Holdinstead of inserting rows, and the terminal lists each refused hold with the next sailing that has room.- Done when
A replay test against a full sailing refuses every hold, and the terminal lists them all.
6Expire offline holds after ten minutes
A hold made offline lapses after ten minutes, the same as a hold made in the app.
Expire offline holds after ten minutes
A hold made offline lapses after ten minutes, the same as a hold made in the app.
- Addresses
Offline holds never expire, and these were six hours old when they replayed.
- What changes
The terminal stamps each offline hold with its time, drops it after ten minutes, and tells the clerk which holds lapsed.
- Note
The office asked for twenty minutes on busy mornings. Ten matches the app, and a clerk can always hold again.
Your reply
Your choices, ready to send. Copy this reply back to your agent when you’re done.
Example do 1, 2, 4; later 3. Notes: 3: after the winter timetable.
Do: follow-ups 1, 2, and 4. Later: follow-up 3. Note on follow-up 3: after the winter timetable.
nothing.
Nothing decided yet.