DevOps Lessons from Air France 447 Crash

1. Escalating complexity: DevOps learnings from Air France 447

2. Lindsay Holmwood @auxesis

3. Engineering Manager @ Bulletproof Networks

5. cucumber-nagios Visage Flapjack

7. • On 31 May 2009, Air France 447 departed from Rio de Janeiro-Galeão International Airport at 22:29 UTC. It was scheduled to arrive at Paris-Charles de Gaulle International Airport 11 hours later.

8. • On 31 May 2009, Air France 447 departed from Rio de Janeiro-Galeão International Airport at 22:29 UTC. It was scheduled to arrive at Paris-Charles de Gaulle International Airport 11 hours later. • 3 hours and 45 minutes later, it crashed into the Atlantic Ocean, killing 216 passengers, and 12 aircrew.

9. • On 31 May 2009, Air France 447 departed from Rio de Janeiro-Galeão International Airport at 22:29 UTC. It was scheduled to arrive at Paris-Charles de Gaulle International Airport 11 hours later. • 3 hours and 45 minutes later, it crashed into the Atlantic Ocean, killing 216 passengers, and 12 aircrew. • There were no survivors.

11. • This is AF447’s ﬂight path:

13. • AF447 charted a course through a band of equatorial thunderstorms

15. • This is what happened in the last 15 minutes of the ﬂight.

17. 02:03:44 (Bonin) The inter-tropical convergence... look, we're in it, between 'Salpu' and 'Tasil.' And then, look, we're right in it... 02:05:55 (Robert) Yes, let's call them in the back, to let them know... 02:05:59 (FA) Yes? Marilyn. 02:06:04 (Bonin) Yes, Marilyn, it's Pierre up front... Listen, in 2 minutes, we're going to be getting into an area where things are going to be moving around a little bit more than now. You'll want to take care. 02:06:13 (FA) Okay, we should sit down then? 02:06:15 (Bonin) Well, I think that's not a bad idea. Give your friends a heads-up. 02:06:18 (FA) Yeah, okay, I'll tell the others in the back. Thanks a lot. 02:06:19 (Bonin) I'll call you back as soon as we're out of it. 02:06:20 (FA) Okay.

18. 02:03:44 (Bonin) The inter-tropical convergence... look, we're in it, between 'Salpu' and 'Tasil.' And then, look, we're right in it... 02:05:55 (Robert) Yes, let's call them in the back, to let them know... 02:05:59 (FA) Yes? Marilyn. 02:06:04 (Bonin) Yes, Marilyn, it's Pierre up front... Listen, in 2 minutes, we're going to be getting into an area where things are going to be moving around a little bit more than now. You'll want to take care. 02:06:13 (FA) Okay, we should sit down then? 02:06:15 (Bonin) Well, I think that's not a bad idea. Give your friends a heads-up. 02:06:18 (FA) Yeah, okay, I'll tell the others in the back. Thanks a lot. 02:06:19 (Bonin) I'll call you back as soon as we're out of it. 02:06:20 (FA) Okay.

20. 02:06:50 (Bonin) Let's go for the anti-icing system. It's better than nothing. 02:07:00 (Bonin) We seem to be at the end of the cloud layer, it might be okay. 02:08:03 (Robert) You can possibly pull it a little to the left. 02:08:05 (Bonin) You can possibly pull it a little to the left. We're agreed that we're in manual, yeah?

22. Captain Marc Dubois hands control to Robert + Bonin, • and takes the second mandatory rest break.

24. 02:10:06 (Bonin) I have the controls. 02:10:07 (Robert) Okay. 02:10:07 (Robert) What's this? 02:10:15 (Bonin) There's no good... there's no good speed indication. 02:10:16 (Robert) We've lost the, the, the speeds, then? 02:10:27 (Robert) Pay attention to your speed. Pay attention to your speed. 02:10:28 (Bonin) Okay, okay, I'm descending. 02:10:30 (Robert) Stabilize. 02:10:31 (Bonin) Yeah. 02:10:31 (Robert) Descend... It says we're going up... It says we're going up, so descend. 02:10:36 (Robert) Descend!

29. 02:10:37 (Bonin) Here we go, we're descending. 02:10:38 (Robert) Gently! 02:10:41(Bonin) We're... yeah, we're in a climb. 02:10:49 (Robert) Damn it, where is he? 02:10:55 (Robert) Damn it! 02:11:03 (Bonin) I'm in TOGA, huh? 02:11:06 (Robert) Damn it, is he coming or not? 02:11:21 (Robert) We still have the engines! What the hell is happening? I don't understand what's happening. 02:11:21 (Robert) But we’ve got the engines. What's happening? Do you understand what’s happening or not? 02:11:32 (Bonin) I don't have control of the plane any more now. I don't have control of the plane at all!

34. 02:11:37 (Robert) Controls to the left! 02:11:41 (Robert) ...what is that? 02:11:41 (Bonin) I have the impression (we have) the speed 02:11:42 (Captain) Er, what are you doing? 02:11:43 (Robert) What’s happening? I don’t know, I don’t know what’s happening 02:11:45 (Bonin) We’re losing control of the aeroplane there 02:11:46 (Robert) We lost all control of the aeroplane. We don’t understand anything. We’ve tried everything. 02:11:51 (Captain) So take that, take that 02:11:55 (Robert) Take that, take that 02:11:57 (Robert) Try to take that

38. 02:11:58 (Bonin) I have a problem - it’s that I don’t have vertical speed indication 02:12:01 (Captain) Alright 02:12:01 (Bonin) I have no more displays 02:12:02 (Robert) We have no valid displays 02:12:04 (Bonin) I have the impression that we have some crazy speed, no? What do you think? 02:12:06 (Robert) No. 02:12:07 (Bonin) No? 02:12:07 (Robert) No, above all don't extend the 02:12:07 (Bonin) Okay 02:12:09 (Robert) Don't extend

39. 02:11:58 (Bonin) I have a problem - it’s that I don’t have vertical speed indication 02:12:01 (Captain) Alright 02:12:01 (Bonin) I have no more displays 02:12:02 (Robert) We have no valid displays 02:12:04 (Bonin) I have the impression that we have some crazy speed, no? What do you think? 02:12:06 (Robert) No. 02:12:07 (Bonin) No? 02:12:07 (Robert) No, above all don't extend the 02:12:07 (Bonin) Okay 02:12:09 (Robert) Don't extend

41. 02:12:11 (Bonin) So we’re still going down 02:12:12 (Robert) We’re pulling 02:12:14 (Robert) What do you think about it? What do you think? What do we need to do? 02:12:15 (Captain) There - I don’t know. There - it’s going down. 02:12:19 (Bonin) There you are. 02:12:20 (Bonin) That’s good we should be wings level, no it won’t 02:12:23 (Captain) The wings to ﬂat horizon, the standby horizon 02:12:25 (Robert) The horizon! 02:12:26 (Bonin) Okay 02:12:26 (Robert) Speed?

42. 02:12:11 (Bonin) So we’re still going down 02:12:12 (Robert) We’re pulling 02:12:14 (Robert) What do you think about it? What do you think? What do we need to do? 02:12:15 (Captain) There - I don’t know. There - it’s going down. 02:12:19 (Bonin) There you are. 02:12:20 (Bonin) That’s good we should be wings level, no it won’t 02:12:23 (Captain) The wings to ﬂat horizon, the standby horizon 02:12:25 (Robert) The horizon! 02:12:26 (Bonin) Okay 02:12:26 (Robert) Speed?

44. 02:12:27 (Robert) You're climbing 02:12:28 (Robert) You're going down down down 02:12:28 (Captain) Going down 02:12:30 (Bonin) Am I going down now? 02:12:31 (Robert) Go down 02:12:32 (Captain) No you climb there 02:12:32 (Bonin) I'm climbing okay so we're going down 02:12:34 (Captain) You're climbing 02:12:39 (Bonin) Okay, we're in TOGA 02:12:41 (Bonin) What are we here? 02:12:41 (Bonin) On alti what do we have here?

48. 02:12:43 (Captain) It's impossible 02:12:45 (Bonin) In alti what do we have? 02:12:47 (Robert) What do you mean on altitude? 02:12:48 (Bonin) Yeah yeah yeah, I'm going down, no? 02:12:50 (Robert) You're going down, yes 02:12:52 (Captain) Hey you 02:12:53 (Captain) You're in 02:12:54 (Captain) Get the wings horizontal 02:12:56 (Robert) Get the wings horizontal 02:12:56 (Bonin) That's what I'm trying to do 02:12:57 (Captain) Get the wings horizontal!

52. 02:12:58 (Bonin) I'm at the limit... with the roll 02:13:00 (Captain) The rudder bar 02:13:05 (Captain) Wings horizontal.. go... gently, gently 02:13:11 (Captain) Hey er... 02:13:11 (Robert) We lost it all at the left 02:13:13 (Robert) I've got nothing there 02:13:15 (Captain) What do you have? 02:13:17 (Captain) No wait 02:13:18 (Bonin) We're there, we're there, we're passing level one hundred 02:13:19 (Robert) Wait, me, I have, I have the controls, eh? 02:13:25 (Bonin) What is... how come we're continuing to go down right now?

56. 02:13:28 (Robert) Try to ﬁnd what you can do with your controls up there 02:13:30 (Robert) The primaries and so on 02:13:30 (Captain) It won't do anything 02:13:31 (Captain) It won't do anything 02:13:31 (Bonin) At level one hundred 02:13:36 (Bonin) Nine thousand feet 02:13:38 (Captain) Careful with the rudder bar there 02:13:39 (Robert) Climb, climb, climb, climb 02:13:40 (Bonin) But I've been at maxi nose-up for a while 02:13:42 (Captain) No, no, no... don't climb 02:13:43 (Robert) Descend, then... Give me the controls... Give me the controls!

60. 02:13:46 (Bonin) Go ahead, you have the controls. We are still in TOGA, eh? 02:13:53 (Captain) AP OFF 02:13:59 (Bonin) Gentlemen 02:14:05 (Captain) Watch out, you're pitching up there 02:14:05 (Robert) I'm pitching up 02:14:06 (Captain) You're pitching up 02:14:07 (Robert) I'm pitching up 02:14:07 (Bonin) Well, we need to, we are at four thousand feet...

61. 02:13:46 (Bonin) Go ahead, you have the controls. We are still in TOGA, eh? 02:13:53 (Captain) AP OFF 02:13:59 (Bonin) Gentlemen 02:14:05 (Captain) Watch out, you're pitching up there 02:14:05 (Robert) I'm pitching up 02:14:06 (Captain) You're pitching up 02:14:07 (Robert) I'm pitching up 02:14:07 (Bonin) Well, we need to, we are at four thousand feet...

63. 02:14:10 (Captain) You're pitching up 02:14:18 (Captain) Go on pull 02:14:19 (Bonin) Let's go, pull up, pull up, pull up 02:14:23 (Bonin) Damn it, we're going to crash... This can't be happening! 02:14:25 (Bonin) But what's happening? 02:14:26 (Captain) Ten degrees of pitch... 02:14:28 End of recording

68. 02:14:23 (Bonin) Damn it, we're going to crash... This can't be happening!

69. 02:14:23 (Bonin) Damn it, we're going to crash... This can't be happening!

72. • Final Air France 447 Report: Pilots misunderstood their situation • Poorly-trained pilots to blame for Air France crash that killed 228 • Final Air France crash report says pilots failed to react swiftly • Air France 447 downed as crew ignored alarms • Air France 447 crash a result of crew ignoring alarms

73. • The Atlantic • Daily Mail • CNN • New Scientist • Gizmodo

74. Convenient narrative

75. “root cause”

76. “human error”

77. Bad apples

78. “if we weed out the bad apples, the system will equalise”

79. What you call "root cause" is simply the place you stop looking any further -- Sidney Dekker Professor of Human Factors & Flight Safety, Lund University

80. Dubois 10,988 flying hours, of which 6,258 as total Captain hours on type 1,747, all as Captain in the previous six months 346 hours, 18 landings, 15 take-offs in the previous three months 168 hours, 8 landings, 6 take-offs in the previous 30 days 57 hours, 3 landings, 2 take-offs

81. Robert total 6,547 flying hours hours on type 4,479 flying hours in the previous six months 204 hours, 9 landings, 11 take-offs in the previous three months 99 hours, 6 landings, 5 take-offs in the previous 30 days 39 hours, 2 landings, 2 take-offs

82. Bonin total 2,936 flying hours hours on type 807 in the previous six months 368 hours, 16 landings, 18 take-offs in the previous three months 191 hours, 7 landings, 8 take-offs in the previous 30 days 61 hours, 1 landings, 2 take-offs

84. Critical ﬂaw: How would other pilots react under the same circumstances?

85. What appears in the crew behavior is that most probably, a diﬀerent crew should have done the same action. So, we cannot blame this crew. What we can say is that most probably this crew and most crews were not prepared to face such an event. -- Jean-Paul Troadec Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile

86. What appears in the crew behavior is that most probably, a diﬀerent crew should have done the same action. So, we cannot blame this crew. What we can say is that most probably this crew and most crews were not prepared to face such an event. -- Jean-Paul Troadec Bureau d'Enquêtes et d'Analyses pour la Sécurité de l'Aviation Civile

87. Actors in a complex system

88. Systems in a complex system

89. Systems in a series of nested complex systems

90. “root cause”

91. Cartesian-Newtonian worldview

93. hindsight != foresight

94. [hindsight] converts a once vague, unlikely future into an immediate, certain past -- Sidney Dekker Professor of Human Factors & Flight Safety, Lund University

95. We have all the facts

107. Investigation took 3 years

108. Event unfolded in 10 minutes

109. Fog of War

110. Limited facts at hand in a rapidly developing situation

111. Local rationality

112. “people make what they think are best decisions based on data at hand”

113. Hindsight aﬀords us global rationality

115. What systems were in play?

116. Modes of operation

117. Flight control modes

118. Normal law ground, ﬂight, ﬂare modes Alternate law alternate law 1, alternate law 2

123. Law reconﬁguration feedback

125. There are three major categories of message that can be transmitted: • non-vocal (ATC) communication messages with an air traﬃc control centre • operational communication messages (AOC) with the operator’s operations centre • maintenance messages, exclusively from the aircraft to the maintenance centre

126. Time of Reception Message 02:10 WRN/WN0906010210 221002006AUTO FLT AP OFF 02:10 WRN/WN0906010210 226201006AUTO FLT REAC W/S DET FAULT 02:10 WRN/WN0906010210 279100506F/CTL ALTN LAW 02:10 WRN/WN0906010210 228300206FLAG ON CAPT PFD SPD LIMIT 02:10 #0210/+2.98-30.59 02:10 WRN/WN0906010210 228301206FLAG ON F/O PFD SPD LIMIT 02:10 WRN/WN0906010210 223002506AUTO FLT A/THR OFF 02:10 WRN/WN0906010210 344300506NAV TCAS FAULT 02:11 WRN/WN0906010210 228300106FLAG ON CAPT PFD FD 02:11 WRN/WN0906010210 228301106FLAG ON F/O PFD FD 02:11 WRN/WN0906010210 272302006F/CTL RUD TRV LIM FAULT 02:11 WRN/WN0906010210 279045506MAINTENANCE STATUS EFCS 2 02:11 WRN/WN0906010210 279045006MAINTENANCE STATUS EFCS 1 02:11 FLR/FR0906010210 34111506EFCS2 1,EFCS1,AFS,,,,,PROBE-PITOT 1X2 / 2X3 / 1X3 (9DA),HARD 02:11 FLR/FR0906010210 27933406EFCS1 X2,EFCS2X,,,,,,FCPC2 (2CE2) /WRG:ADIRU1 BUS ADR1-2 TO FCPC2,HARD 02:12 WRN/WN0906010211 341200106FLAG ON CAPT PFD FPV 02:12 WRN/WN0906010211 341201106FLAG ON F/O PFD FPV 02:12 WRN/WN0906010212 341040006NAV ADR DISAGREE 02:13 FLR/FR0906010211 34220006ISIS 1,,,,,,,ISIS(22FN-10FC) SPEED OR MACH FUNCTION,HARD 02:13 FLR/FR0906010211 34123406IR2 1,EFCS1X,IR1,IR3,,,,ADIRU2 (1FP2),HARD 2:13:16 ~ 2:13:41 Possible "Loss of Signal" with satellite 02:13 WRN/WN0906010213 279002506F/CTL PRIM 1 FAULT 02:13 WRN/WN0906010213 279004006F/CTL SEC 1 FAULT 02:14 WRN/WN0906010214 341036006MAINTENANCE STATUS ADR 2 02:14 FLR/FR0906010213 22833406AFS 1,,,,,,,FMGEC1(1CA1),INTERMITTENT 02:14 WRN/WN0906010214 213100206ADVISORY CABIN VERTICAL SPEED

127. 02:10 WRN/WN0906010210 279100506F/CTL ALTN LAW

128. 02:10 WRN/WN0906010210 279100506F/CTL ALTN LAW

129. small textual warning here

130. Realisation

131. 02:13:40 (Bonin) But I've been at maxi nose-up for a while 02:13:42 (Captain) No, no, no... don't climb 02:13:43 (Robert) Descend, then... Give me the controls... Give me the controls! ... 02:14:28 End of recording

133. How does your HA provide feedback?

134. Reconﬁguration feedback?

135. How do these modes behave diﬀerently?

136. What about modes you haven’t seen?

138. Sensory feedback

139. Obvious change in color, size, font

140. Know how colour is processed by the brain

141. Familiarise yourself with type

144. Optimise for 3am you

146. Input control

147. Co-pilot feedback

148. Averaged input

149. dual input feedback

150. CRM

151. Startling eﬀect

153. Are your inputs averaged?

154. How do your engineers troubleshoot during incidents?

155. Every man for himself?

156. How do you co- ordinate change?

157. Does someone have overview?

158. How is that responsibility assigned?

159. How is information disseminated?

160. How does the business know what is happening?

161. Do you have a process?

162. Do you practice this?

163. What data do you rely on?

165. Pair

166. Vocalise

167. Minimise & Compartmentalise

168. Record

169. Timeline

170. maintained by co-ordinator

172. HUD

173. isolated sensors

175. diﬀerent values

176. discrepancies

178. CRM

180. Contextual navigation

181. diﬀerent navigation requirements

182. dashboards

183. deep dive on details

184. test a theory

185. scientiﬁc method: improvised

186. linkable

187. correlation

188. human pattern recognition

189. human pattern recognition (provided there is enough adaptive capacity)

191. Stream of alerts

192. 70 stall warnings

194. “They should have reacted!”

195. autopilot disconnect

196. alternate law reconﬁguration

197. alert priority level?

198. overwhelmed by feedback

199. Alert Fatigue

200. startling eﬀect

201. reduced adaptive capacity

203. dampening

205. Brute force: manual silence

206. limit # of engineers who watch alerts & graphs

207. smarter alert aggregation?

208. PagerDuty

209. Flapjack

211. Systems thinking

212. System capable of failure

213. System capable of success

215. • System that enables communication

216. • System that enables communication • System that exposes secrets

217. • System that enables communication • System that exposes secrets • System that rob us

218. • System that enables communication • System that exposes secrets • System that rob us • System that funds innovation

219. • System that enables communication • System that exposes secrets • System that rob us • System that funds innovation • System that kills us

220. • System that enables communication • System that exposes secrets • System that rob us • System that funds innovation • System that kills us • System that allow us to ﬂy across the world

221. Failure is pervasive

222. Failure is complex

223. Failure is just another mode of operation

224. Your system may not control fate of people’s lives

225. But people may depend on it

227. Anthropocentrism

228. Technocentrism

229. The squishy middle ground

230. Operable Systems man + machine

231. No amoral actors

232. We need to look at it from a systems approach, a human/technology system that has to work together. This involves aircraft design and certiﬁcation, training and human factors. If you look at the human factors alone, then you're missing half or two-thirds of the total system failure -- Chesley Sullenberger Pilot, US 1549, Hudson River Ditching

233. We need to look at it from a systems approach, a human/technology system that has to work together. This involves aircraft design and certiﬁcation, training and human factors. If you look at the human factors alone, then you're missing half or two-thirds of the total system failure -- Chesley Sullenberger Pilot, US 1549, Hudson River Ditching

234. • Damn it, we're going to crash... This can't be happening!

236. Thank you

237. Liked the talk? Let @auxesis know! Thank you

238. Sidney Dekker Field Guide to Understand Human Error Drift Into Failure Just Culture Jon Rauser Look at Your Data @ Velocity Ryan Tomayko Distributed Management @ Monktoberfest 2012 BEA Report on AF447 incident

DevOps Lessons from Air France 447 Crash

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (14)

More from Lindsay Holmwood

More from Lindsay Holmwood (12)

Recently uploaded

Recently uploaded (20)

DevOps Lessons from Air France 447 Crash