Escalating complexity: DevOps learnings from Air France 447

Escalating complexity:

DevOps learnings from Air France 447

Lindsay Holmwood@auxesis

Engineering Manager@

Bulletproof Networks

cucumber-nagiosVisage

Flapjack

•On 31 May 2009, Air France 447 departed from Rio de Janeiro-Galeão International Airport at 22:29 UTC. It was scheduled to arrive at Paris-Charles de Gaulle International Airport 11 hours later.

•3 hours and 45 minutes later, it crashed into the Atlantic Ocean, killing 216 passengers, and 12 aircrew.

•On 31 May 2009, Air France 447 departed from Rio de Janeiro-Galeão International Airport at 22:29 UTC. It was scheduled to arrive at Paris-Charles de Gaulle International Airport 11 hours later.

•3 hours and 45 minutes later, it crashed into the Atlantic Ocean, killing 216 passengers, and 12 aircrew.

•There were no survivors.

•This is AF447’s flight path:

•AF447 charted a course through a band of equatorial thunderstorms

•This is what happened in the last 15 minutes of the flight.

02:03:44 (Bonin) The inter-tropical convergence... look, we're in it, between 'Salpu' and 'Tasil.' And then, look, we're right in it...

02:05:55 (Robert) Yes, let's call them in the back, to let them know...

02:05:59 (FA) Yes? Marilyn.

02:06:04 (Bonin) Yes, Marilyn, it's Pierre up front... Listen, in 2 minutes, we're going to be getting into an area where things are going to be moving arounda little bit more than now. You'll want to take care.

02:06:13 (FA) Okay, we should sit down then?

02:06:15 (Bonin) Well, I think that's not a bad idea. Give your friends a heads-up.

02:06:18 (FA) Yeah, okay, I'll tell the others in the back. Thanks a lot.

02:06:19 (Bonin) I'll call you back as soon as we're out of it.

02:06:20 (FA) Okay.

02:03:44 (Bonin) The inter-tropical convergence... look, we're in it, between 'Salpu' and 'Tasil.' And then, look, we're right in it...

02:05:55 (Robert) Yes, let's call them in the back, to let them know...

02:05:59 (FA) Yes? Marilyn.

02:06:04 (Bonin) Yes, Marilyn, it's Pierre up front... Listen, in 2 minutes, we're going to be getting into an area where things are going to be moving arounda little bit more than now. You'll want to take care.

02:06:13 (FA) Okay, we should sit down then?

02:06:15 (Bonin) Well, I think that's not a bad idea. Give your friends a heads-up.

02:06:18 (FA) Yeah, okay, I'll tell the others in the back. Thanks a lot.

02:06:19 (Bonin) I'll call you back as soon as we're out of it.

02:06:20 (FA) Okay.

02:06:50 (Bonin) Let's go for the anti-icing system. It's better than nothing.

02:07:00 (Bonin) We seem to be at the end of the cloud layer, it might be okay.

02:08:03 (Robert) You can possibly pull it a little to the le!.

02:08:05 (Bonin) You can possibly pull it a little to the le!. We're agreed that we're inmanual, yeah?

•Captain Marc Dubois hands control to Robert + Bonin, and takes the second mandatory rest break.

02:10:06 (Bonin) I have the controls.

02:10:07 (Robert) Okay.

02:10:07 (Robert) What's this?

02:10:15 (Bonin) There's no good... there's no good speed indication.

02:10:16 (Robert) We've lost the, the, the speeds, then?

02:10:27 (Robert) Pay attention to your speed. Pay attention to your speed.

02:10:28 (Bonin) Okay, okay, I'm descending.

02:10:30 (Robert) Stabilize.

02:10:31 (Bonin) Yeah.

02:10:31 (Robert) Descend... It says we're going up... It says we're going up, so descend.

02:10:36 (Robert) Descend!

02:10:37 (Bonin) Here we go, we're descending.

02:10:38 (Robert) Gently!

02:10:41(Bonin) We're... yeah, we're in a climb.

02:10:49 (Robert) Damn it, where is he?

02:10:55 (Robert) Damn it!

02:11:03 (Bonin) I'm in TOGA, huh?

02:11:06 (Robert) Damn it, is he coming or not?

02:11:21 (Robert) We still have the engines! What the hell is happening? I don't understand what's happening.

02:11:21 (Robert) But we’ve got the engines. What's happening? Do you understand what’s happening or not?

02:11:32 (Bonin) I don't have control of the plane any more now. I don't have control of the plane at all!

02:11:37 (Robert) Controls to the le!!

02:11:41 (Robert) ...what is that?

02:11:41 (Bonin) I have the impression (we have) the speed

02:11:42 (Captain) Er, what are you doing?

02:11:43 (Robert) What’s happening? I don’t know, I don’t know what’s happening

02:11:45 (Bonin) We’re losing control of the aeroplane there

02:11:46 (Robert) We lost all control of the aeroplane. We don’t understand anything.We’ve tried everything.

02:11:51 (Captain) So take that, take that

02:11:55 (Robert) Take that, take that

02:11:57 (Robert) Try to take that

02:11:58 (Bonin) I have a problem - it’s that I don’t have vertical speed indication

02:12:01 (Captain) Alright

02:12:01 (Bonin) I have no more displays

02:12:02 (Robert) We have no valid displays

02:12:04 (Bonin) I have the impression that we have some crazy speed, no? What do you think?

02:12:06 (Robert) No.

02:12:07 (Bonin) No?

02:12:07 (Robert) No, above all don't extend the

02:12:07 (Bonin) Okay

02:12:09 (Robert) Don't extend

02:11:58 (Bonin) I have a problem - it’s that I don’t have vertical speed indication

02:12:01 (Captain) Alright

02:12:01 (Bonin) I have no more displays

02:12:02 (Robert) We have no valid displays

02:12:04 (Bonin) I have the impression that we have some crazy speed, no? What do you think?

02:12:06 (Robert) No.

02:12:07 (Bonin) No?

02:12:07 (Robert) No, above all don't extend the

02:12:09 (Robert) Don't extend

02:12:11 (Bonin) So we’re still going down

02:12:12 (Robert) We’re pulling

02:12:14 (Robert) What do you think about it? What do you think? What do we need to do?

02:12:15 (Captain) There - I don’t know. There - it’s going down.

02:12:19 (Bonin) There you are.

02:12:20 (Bonin) That’s good we should be wings level, no it won’t

02:12:23 (Captain) The wings to flat horizon, the standby horizon

02:12:25 (Robert) The horizon!

02:12:26 (Robert) Speed?

02:12:11 (Bonin) So we’re still going down

02:12:12 (Robert) We’re pulling

02:12:14 (Robert) What do you think about it? What do you think? What do we need to do?

02:12:15 (Captain) There - I don’t know. There - it’s going down.

02:12:19 (Bonin) There you are.

02:12:20 (Bonin) That’s good we should be wings level, no it won’t

02:12:23 (Captain) The wings to flat horizon, the standby horizon

02:12:25 (Robert) The horizon!

02:12:26 (Robert) Speed?

02:12:27 (Robert) You're climbing

02:12:28 (Robert) You're going down down down

02:12:28 (Captain) Going down

02:12:30 (Bonin) Am I going down now?

02:12:31 (Robert) Go down

02:12:32 (Captain) No you climb there

02:12:32 (Bonin) I'm climbing okay so we're going down

02:12:34 (Captain) You're climbing

02:12:39 (Bonin) Okay, we're in TOGA

02:12:41 (Bonin) What are we here?

02:12:41 (Bonin) On alti what do we have here?

02:12:43 (Captain) It's impossible

02:12:45 (Bonin) In alti what do we have?

02:12:47 (Robert) What do you mean on altitude?

02:12:48 (Bonin) Yeah yeah yeah, I'm going down, no?

02:12:50 (Robert) You're going down, yes

02:12:52 (Captain) Hey you

02:12:53 (Captain) You're in

02:12:54 (Captain) Get the wings horizontal

02:12:56 (Robert) Get the wings horizontal

02:12:56 (Bonin) That's what I'm trying to do

02:12:57 (Captain) Get the wings horizontal!

02:12:58 (Bonin) I'm at the limit... with the roll

02:13:00 (Captain) The rudder bar

02:13:05 (Captain) Wings horizontal.. go... gently, gently

02:13:11 (Captain) Hey er...

02:13:11 (Robert) We lost it all at the le!

02:13:13 (Robert) I've got nothing there

02:13:15 (Captain) What do you have?

02:13:17 (Captain) No wait

02:13:18 (Bonin) We're there, we're there, we're passing level one hundred

02:13:19 (Robert) Wait, me, I have, I have the controls, eh?

02:13:25 (Bonin) What is... how come we're continuing to go down right now?

02:13:28 (Robert) Try to find what you can do with your controls up there

02:13:30 (Robert) The primaries and so on

02:13:30 (Captain) It won't do anything

02:13:31 (Bonin) At level one hundred

02:13:36 (Bonin) Nine thousand feet

02:13:38 (Captain) Careful with the rudder bar there

02:13:39 (Robert) Climb, climb, climb, climb

02:13:40 (Bonin) But I've been at maxi nose-up for a while

02:13:42 (Captain) No, no, no... don't climb

02:13:43 (Robert) Descend, then... Give me the controls... Give me the controls!

02:13:46 (Bonin) Go ahead, you have the controls. We are still in TOGA, eh?

02:13:53 (Captain) AP OFF

02:13:59 (Bonin) Gentlemen

02:14:05 (Captain) Watch out, you're pitching up there

02:14:05 (Robert) I'm pitching up

02:14:06 (Captain) You're pitching up

02:14:07 (Bonin) Well, we need to, we are at four thousand feet...

02:13:46 (Bonin) Go ahead, you have the controls. We are still in TOGA, eh?

02:13:53 (Captain) AP OFF

02:13:59 (Bonin) Gentlemen

02:14:05 (Captain) Watch out, you're pitching up there

02:14:07 (Bonin) Well, we need to, we are at four thousand feet...

02:14:18 (Captain) Go on pull

02:14:19 (Bonin) Let's go, pull up, pull up, pull up

02:14:23 (Bonin) Damn it, we're going to crash... This can't be happening!

02:14:25 (Bonin) But what's happening?

02:14:26 (Captain) Ten degrees of pitch...

02:14:28 End of recording

•Final Air France 447 Report: Pilots misunderstood their situation

•Poorly-trained pilots to blame for Air France crash that killed 228

•Final Air France crash report says pilots failed to react swiftly

•Air France 447 downed as crew ignored alarms

•Air France 447 crash a result of crew ignoring alarms

•The Atlantic

•Daily Mail

•CNN

•New Scientist

•Gizmodo

Convenient narrative

“root cause”

“human error”

Bad apples

“if we weed out the bad apples, the system

will equalise”

What you call "root cause" is simply the place you stop looking any further

-- Sidney DekkerProfessor of Human Factors & Flight Safety, Lund University

Duboistotal 10,988 flying hours, of which 6,258 as

Captain

hours on type 1,747, all as Captain

in the previous six months 346 hours, 18 landings, 15 take-offs

in the previous three months 168 hours, 8 landings, 6 take-offs

in the previous 30 days 57 hours, 3 landings, 2 take-offs

Roberttotal 6,547 flying hours

hours on type 4,479 flying hours

Bonintotal 2,936 flying hours

hours on type 807

Critical flaw:How would other pilots

react under the same circumstances?

What appears in the crew behavior is that most probably, a different crew should have done the same action. So, we cannot blame this crew. What we can say is that most probably this crew and most crews were not prepared to face such an event.

-- Jean-Paul Troadec Bureau d'Enquêtes et d'Analyses

pour la Sécurité de l'Aviation Civile

What appears in the crew behavior is that most probably, a different crew should have done the same action. So, we cannot blame this crew. What we can say is that most probably this crew and most crews were not prepared to face such an event.

-- Jean-Paul Troadec Bureau d'Enquêtes et d'Analyses

pour la Sécurité de l'Aviation Civile

Actors in a complex system

Systems in a complex system

Systems in aseries of nested

complex systems

“root cause”

Cartesian-Newtonian worldview

hindsight != foresight

[hindsight] converts a once vague, unlikely future into an

immediate, certain past-- Sidney Dekker

Professor of Human Factors & Flight Safety, Lund University

We have all the facts

Investigation took

3 years

Event unfolded in

10 minutes

Fog of War

Limited facts at handin a rapidly

developing situation

Local rationality

“people make what they think are best decisions based on data at hand”

Hindsight affords us global

rationality

What systems were in play?

Modes of operation

Flight control modes

Normal lawground, flight, flare modes

Alternate lawalternate law 1, alternate law 2

Law reconfiguration

feedback

There are three major categories of message that can be transmitted:

• non-vocal (ATC) communication messages with an air traffic control centre

• operational communication messages (AOC) with the operator’s operations centre

• maintenance messages, exclusively from the aircra# to the maintenance centre

Time of Reception Message

02:10 WRN/WN0906010210 221002006AUTO FLT AP OFF

02:10 WRN/WN0906010210 226201006AUTO FLT REAC W/S DET FAULT

02:10 WRN/WN0906010210 279100506F/CTL ALTN LAW

02:10 WRN/WN0906010210 228300206FLAG ON CAPT PFD SPD LIMIT

02:10 #0210/+2.98-30.59

02:10 WRN/WN0906010210 228301206FLAG ON F/O PFD SPD LIMIT

02:10 WRN/WN0906010210 223002506AUTO FLT A/THR OFF

02:10 WRN/WN0906010210 344300506NAV TCAS FAULT

02:11 WRN/WN0906010210 228300106FLAG ON CAPT PFD FD

02:11 WRN/WN0906010210 228301106FLAG ON F/O PFD FD

02:11 WRN/WN0906010210 272302006F/CTL RUD TRV LIM FAULT

02:11 WRN/WN0906010210 279045506MAINTENANCE STATUS EFCS 2

02:11 WRN/WN0906010210 279045006MAINTENANCE STATUS EFCS 1

02:11 FLR/FR0906010210 34111506EFCS2 1,EFCS1,AFS,,,,,PROBE-PITOT 1X2 / 2X3 / 1X3 (9DA),HARD

02:11 FLR/FR0906010210 27933406EFCS1 X2,EFCS2X,,,,,,FCPC2 (2CE2) /WRG:ADIRU1 BUS ADR1-2 TO FCPC2,HARD

02:12 WRN/WN0906010211 341200106FLAG ON CAPT PFD FPV

02:12 WRN/WN0906010211 341201106FLAG ON F/O PFD FPV

02:12 WRN/WN0906010212 341040006NAV ADR DISAGREE

02:13 FLR/FR0906010211 34220006ISIS 1,,,,,,,ISIS(22FN-10FC) SPEED OR MACH FUNCTION,HARD

02:13 FLR/FR0906010211 34123406IR2 1,EFCS1X,IR1,IR3,,,,ADIRU2 (1FP2),HARD

2:13:16 ~ 2:13:41 Possible "Loss of Signal" with satellite

02:13 WRN/WN0906010213 279002506F/CTL PRIM 1 FAULT

02:13 WRN/WN0906010213 279004006F/CTL SEC 1 FAULT

02:14 WRN/WN0906010214 341036006MAINTENANCE STATUS ADR 2

02:14 FLR/FR0906010213 22833406AFS 1,,,,,,,FMGEC1(1CA1),INTERMITTENT

02:14 WRN/WN0906010214 213100206ADVISORY CABIN VERTICAL SPEED

02:10 WRN/WN0906010210 279100506F/CTL ALTN LAW

small textual warning here

Realisation

How does your HAprovide feedback?

Reconfiguration feedback?

How do these modes behave differently?

What about modes you haven’t seen?

Sensory feedback

Obvious change in

color, size, font

Know how colour is processed

by the brain

Familiarise yourself with type

Optimise for 3am you

Input control

Co-pilot feedback

Averaged input

dual input feedback

Startling effect

Are your inputs averaged?

How do your engineers troubleshoot

during incidents?

Every man for himself?

How do you co-ordinate change?

Does someone have overview?

How is that responsibility

assigned?

How is information disseminated?

How does the business know what is happening?

Do you have a process?

Do you practice this?

What data do you rely on?

Vocalise

Minimise&

Compartmentalise

Record

Timeline

maintained by co-ordinator

isolated sensors

different values

discrepancies

Contextual navigation

different navigation

requirements

dashboards

deep dive on details

test a theory

scientific method:improvised

linkable

correlation

human pattern recognition

(provided there is enough adaptive capacity)

Stream of alerts

70 stall warnings

“They should have reacted!”

autopilot disconnect

alternate law reconfiguration

alert priority level?

overwhelmed by feedback

Alert Fatigue

startling effect

reduced adaptive capacity

dampening

Brute force:

manual silence

limit # of engineers who

watch alerts & graphs

smarter alert aggregation?

PagerDuty

Flapjack

Systems thinking

System capable of failure

System capable of success

•System that enables communication

•System that enables communication•System that exposes secrets

•System that rob us

•System that rob us•System that funds innovation

•System that kills us

•System that kills us•System that allow us to fly across the world

Failure is pervasive

Failure is complex

Failure is just another mode of operation

Your systemmay not

control fate of

people’s lives

But people may depend on it

Anthropocentrism

Technocentrism

The squishy middle ground

Operable Systems

man + machine

No amoral actors

We need to look at it from a systems approach, a human/technology system that has to work together. This involves aircra! design and certification, training and human factors. If you look at the human factors alone, then you're missing half or two-thirds of the total system failure

-- Chesley SullenbergerPilot, US 1549, Hudson River Ditching

We need to look at it from a systems approach, a human/technology system that has to work together. This involves aircra! design and certification, training and human factors. If you look at the human factors alone, then you're missing half or two-thirds of the total system failure

-- Chesley SullenbergerPilot, US 1549, Hudson River Ditching

• Damn it, we're going to crash... This can't be happening!

Thank you

Liked the talk? Let @auxesis know!

Sidney DekkerField Guide to Understand Human ErrorDri# Into FailureJust Culture

Jon RauserLook at Your Data @ Velocity

Ryan TomaykoDistributed Management @ Monktoberfest 2012

BEA Report on AF447 incident

Escalating complexity: DevOps learnings from Air France 447

Education

Transcript of Escalating complexity: DevOps learnings from Air France 447