Two days before Christmas in 2022, a high-school basketball team from Washington was trying to get home from a tournament in Las Vegas.
At a Senate hearing held after the disruption, Chair Maria Cantwell recounted what happened to Coach Bethea, his wife, and a traveling party of more than two dozen players and parents. Their Southwest flight home was cancelled on December 23. They spent five days stranded in Las Vegas, more than $10,000 on hotels and food, and eventually made the trip back to Seattle on an 18-hour charter-bus ride through the snow (U.S. Senate Committee on Commerce, Science, and Transportation, 2024).
Their stories were one among millions.
The U.S. Department of Transportation (DOT) later said Southwest’s operational failure cancelled 16,900 flights and stranded more than two million passengers over the 2022 Christmas holiday and into the New Year. DOT assessed a $140 million civil penalty, in addition to more than $600 million in refunds and reimbursements provided to affected passengers (U.S. Department of Transportation, 2023). Southwest’s own filings show the business impact. The airline reported more than 16,700 cancellations between December 21 and December 31 and estimated an approximately $800 million pre-tax impact in the fourth quarter of 2022. About $410 million came from lost operating revenue, with roughly $390 million tied to increased operating expenses such as customer reimbursements, loyalty points, and additional employee compensation (Southwest Airlines Co., 2024).
What struck me most when i was thinking through this over my morning coffee was that technical recovery eventually becomes a human outcome. A scheduling problem can become a missed Christmas. A communication failure can become another night in a hotel. A system that cannot recover quickly enough can consume money, time, trust, and moments people cannot get back.
The more I studied what happened at Southwest, the less useful it became to think of the event as a story about one old piece of software. I started seeing a story about resilience.
Does That changed how we need to think about the systems we are now building with AI ?
The storm before the calm ? ( i know its corny!)
Winter Storm Elliott was severe. News Channels described it as exceptional in scale, speed, and duration. Weather disrupted airports, aircraft, crews, and schedules across the country. But weather alone does not explain why Southwest’s recovery became so difficult.
In its post-incident action plan, Southwest said cascading, close-in cancellations exceeded its ability to quickly and efficiently reschedule the airline, especially flight crews. To regain control, Southwest reduced its network from a holiday peak of roughly 4,000 daily departures to about 1,500 for several days while teams repositioned aircraft and crews and rebuilt the operation (Southwest Airlines Co., 2023). Interestingly, The airline did not describe a single failed component. Its response included winter equipment, staffing, operational coordination, crew recovery tools, dashboards, alerts, communications, and technology investment.
While the technical explanation seemed simple enough for those in the loop: Old scheduling software failed, so Southwest needed newer scheduling software. The public record is more complicated.
The Southwest Airlines Pilots Association argued in prepared Senate testimony that under-modernized crew-scheduling processes and technology were a causal factor. The union described separate systems for aircraft and crew recovery that could produce conflicting strategies during disruption. Southwest Chief Operating Officer Andrew Watterson gave a narrower account. He testified that SkySolver was a decision-support tool, that a specific issue was being patched, and that the underlying scheduling tool had continued to function, although Southwest was looking to replace it (U.S. Senate Committee on Commerce, Science, and Transportation, 2024).
I find that disagreement useful since complex failures rarely give us one broken box to circle in red. Southwest faced extreme weather, staffing and winter-operations challenges, overloaded processes, technology limitations, fragmented recovery decisions, and growing dependence on manual coordination. The storm triggered the disruption, while the design of the operation shaped how difficult recovery became.
When the system falls behind reality
I like to think of Technical debt with a metaphor: take a shortcut today and pay interest later.
Li, Avgeriou, and Liang (2015) describe technical debt as technical compromises that can create short-term benefit while hurting the long-term health of a software system. Their review also shows that technical debt extends well beyond messy code into architecture, design, testing, requirements, documentation, and other parts of the system. Southwest made that idea feel more concrete to me.
Before December 2022, the airline’s technology was not sitting idle waiting to fail. Flights were taking off. Crews were being scheduled. Customers were checking in. The operation worked.
This shows us the obvious part which is that A system does not have to be broken to be fragile.
A bridge may carry normal traffic every day and still have a load it cannot safely absorb. A service may handle normal demand perfectly and still collapse during a surge. A manual workaround may solve ten exceptions and become useless when there are ten thousand.
The Southwest case adds another wrinkle: during a fast-moving disruption, the system has to keep an accurate enough picture of reality to support good decisions. One cancellation changes several other things. Those changes trigger more decisions, which change the operation again. The Senate record shows why this became difficult. The pilots’ union testified that separate recovery tools could generate conflicting strategies and described situations in which the airline could not efficiently match available crews to aircraft. Southwest itself acknowledged that its technology could not perform some crew-and-aircraft matching quickly and accurately enough at the scale needed during the disruption (U.S. Senate Committee on Commerce, Science, and Transportation, 2024).
In my head, I think of the growing gap between the operation and the system’s representation as state drift. The idea is that the real world has moved, but the digital picture used to make decisions has not caught up yet.
David Woods (2015) describes resilience in part through graceful extensibility: when surprise pushes a system toward its boundaries, can it bring additional adaptive capacity to bear rather than become brittle? In other words, when one part of the system says, “I cannot handle any more,” what happens next? At Southwest, part of the answer was people.
Schedulers and operational teams absorbed exceptions that automation could not resolve quickly enough. That human adaptability was valuable. The problem was scale. As cancellations multiplied, people were being asked to reconcile more crews, aircraft, duty limits, hotels, calls, and schedule changes while the underlying situation continued to change.
If the recovery plan depends on people manually absorbing unlimited complexity, we have not removed the capacity limit. We have only moved it. This is where I started thinking about technical debt as something broader: resilience debt.
A deferred integration, a weak recovery path, an old workflow, or a manual exception process may look inexpensive when the system is operating normally. Under stress, the cost appears somewhere else: slower recovery, overloaded people, inconsistent information, lost revenue, customer harm, or an inability to regain control.
Most days, the interest may be almost invisible until a disruption reveals the rate.
You can modernize without becoming resilient
One of the easiest conclusions to draw from Southwest would be: modernize the legacy systems and move on. It is the old “sweep it under the rug” approach. But modernization is not the same as resilience. To be fair, Southwest did accelerate technology investment. Its 2023 action plan described a $1.3 billion technology budget, roughly 25% above 2019 spending, along with work on crew scheduling, early-warning dashboards, crew recovery, winter operations, and organizational coordination (Southwest Airlines Co., 2023). While those investments matter, modernization and resilience are not synonyms.
Moving an application to the cloud can improve scalability and recovery options. It does not automatically repair inconsistent data. Putting an API in front of an old process can make it easier to access. It does not automatically make the process correct. Replacing a user interface can make work easier. It does not resolve unclear ownership.
A faster service can make a bad decision faster if the information it receives is stale.
We can migrate technical debt. We can wrap it in APIs. We can containerize it.
And now for the grand reveal, we can put an AI agent in front of it.
That last possibility is what made the Southwest case feel current to me.
how I think about it relates to AI
Clearly, Southwest’s 2022 meltdown was not an AI failure. An airline scheduling system and an AI agent are not the same technology, and I do not think it is useful to pretend an AI agent would have prevented what happened. Both depend on some representation of a changing world.
A scheduling system needs to know where crews and aircraft are. An AI agent might need to know whether a transaction completed, which tool succeeded, what state a workflow is in, whether a customer is eligible for an action, or whether another agent already changed something. When that representation becomes stale, incomplete, or inconsistent, automation can continue making decisions against a world that no longer exists.
Here is the gist, Agents add one important difference. They can act on that misunderstanding. An AI operations agent might detect an incident, inspect systems, evaluate options, call tools, update records, communicate decisions, and then repeat the loop. That can increase adaptive capacity because software can process far more exceptions than a person working through them one at a time.
Now lets change one assumption. Say, A data source is ten minutes behind. Two systems disagree about the same resource. A downstream service is not down, but it is returning partial or delayed results. An earlier tool call succeeded, but the agent did not receive confirmation. Another agent is reacting to the same event from a different view of the system.
Do you see that the risk is no longer only that the AI gives a bad answer. The risk is that a bad understanding becomes an action, that action changes the environment, and the next decision is made on top of the change.
Sculley et al. (2015) warned long before today’s agentic systems that production machine-learning systems accumulate hidden debt through data dependencies, feedback loops, entanglement, undeclared consumers, configuration complexity, and changes in the external world. Their larger point was that the model is only one part of the production system.
Agentic systems extend that problem because they can plan, persist, invoke tools, and delegate work. OWASP’s Top 10 for Agentic Applications for 2026 explicitly identifies cascading failures as a risk in which an initial fault propagates across agents, tools, sessions, or workflows and grows into system-wide impact. OWASP also argues for “least-agency” and strong observability so that unnecessary autonomy does not turn a small issue into a much larger one (OWASP Foundation, 2025).
AI can increase the speed at which an incorrect understanding of the world becomes an incorrect action. Should we then avoid AI ? Absolutely not. The same autonomy can increase resilience by absorbing complexity, reacting faster, and helping people recover from situations that would otherwise overwhelm them.
My point is whether we design that authority with boundaries.
NIST’s AI Risk Management Framework treats resilience as more than model accuracy. It calls for monitoring, incident response, recovery, override, decommissioning, and change management, and describes resilient AI systems as systems that can withstand unexpected change or degrade safely and gracefully when necessary (Tabassi, 2023). Rao et al. (2026) note that controlled pre-deployment evaluations cannot reproduce all real-world dynamics. Once deployed, AI systems encounter changing inputs, non-deterministic behavior, drift, human interaction, and unexpected consequences. Their recommendation is not simply “test more before launch.” It is to build the ability to observe what happens after launch.
I strongly agree that the hardest failures are not always the ones where a component stops working. Sometimes the components are still working while the system’s understanding of reality is getting worse. Isn’t that scary ?
The questions I ask differently now
The Southwest case changed the questions I want to ask when we give AI more responsibility inside a real system.
What happens when the data is not obviously wrong, just late?
A clean failure is often easier to detect than stale or contradictory state. I want to know how the system recognizes uncertainty before it acts on it.
What happens when a dependency degrades instead of disappearing?
A service returning errors is visible. A service responding slowly, incompletely, or inconsistently can be more dangerous because the workflow keeps moving.
How do we know we are approaching the system’s limit?
I do not want the first capacity signal to be total failure. Retries, rising manual interventions, disagreement between sources, queue growth, human overrides, and longer decision times can all be early signs.
When does automation stop acting?
An agent does not need to finish every task. Sometimes stopping, escalating, asking for confirmation, or returning control to a person is the successful outcome.
Can a human actually understand what the automation has done?
A nominal human-in-the-loop is not enough if the system has already taken hundreds of interconnected actions that an operator cannot reconstruct. Observability has to preserve the sequence, state, rationale, and authority needed to intervene.
Have we practiced recovery rather than only tested success?
What happens when the model is fine but the data is stale? When the tool works only some of the time? When two systems disagree? When an agent stops halfway through a workflow? When a person takes control?
And there is one question I do not want architecture reviews to lose:
Who experiences the consequence when recovery fails?
Eventually the diagram ends.
A person is on the other side.
Measure recovery, not modernization
There is a useful epilogue to the Southwest story.
By 2025, DOT said Southwest had made more than $1 billion in operational investments since the 2022 failure, including $112.4 million in Network Operations Control. Those investments covered areas such as flight planning, gate optimization, movement control, and aircraft-and-crew recovery. DOT credited the investments with contributing to measurable operational improvement (DOT, 2025).
For the first nine months of 2025, Southwest ranked third among the 10 largest U.S. marketing carriers in both on-time performance and completion factor. In 2022, it had ranked sixth in on-time performance and eighth in completion factor (DOT, 2025).
Those rankings do not prove that every resilience problem was solved, and they do not give us a controlled experiment showing which individual investment caused which improvement. They do show a better way to talk about modernization.
We should pause and ask whether the operation became better at doing its job and recovering when conditions became difficult. That is the same standard we should bring into AI.
When reality exceeds what we designed for, how does the system behave—and how do we regain control?
I began with the story of people trying to get home for Christmas because resilience is easy to make abstract. We draw boxes, arrows, failover paths, queues, regions, models, agents, and tools. Those diagrams are necessary, but they are not the end of the system.
In 2022, the other end was a basketball team trying to get back to Seattle, families missing time together, and millions of travelers trying to understand what would happen next.
As AI becomes more deeply involved in financial decisions, customer service, operations, software delivery, healthcare workflows, and other parts of daily life, the distance between technical behavior and human consequence gets shorter. AI can help us absorb more complexity. It can help us notice trouble earlier. It can evaluate options and coordinate recovery at a scale people alone cannot.
That is exactly why resilience has to grow with autonomy.
The part of the Southwest story I want to remember is that a system can continue operating until reality moves beyond what its processes, technology, and people can absorb.
What happens next is the real test and in the age of AI, we should be asking that question more often.
References
Li, Z., Avgeriou, P., & Liang, P. (2015). A systematic mapping study on technical debt and its management. Journal of Systems and Software, 101, 193–220. https://doi.org/10.1016/j.jss.2014.12.027
OWASP Foundation. (2025, December 9). OWASP Top 10 for agentic applications for 2026. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/
Rao, A. K., Keller, A. J., Kalra, N., Steed, R., Kwegyir-Aggrey, K., Klyman, K., Staheli, D., & Bergman, A. S. (2026). Challenges to the monitoring of deployed AI systems (NIST AI 800-4). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.800-4
Sculley, D., Holt, G., Golovin, D., Davydov, E., Phillips, T., Ebner, D., Chaudhary, V., Young, M., Crespo, J.-F., & Dennison, D. (2015). Hidden technical debt in machine learning systems. Advances in Neural Information Processing Systems, 28, 2503–2511. https://papers.nips.cc/paper/2015/hash/86df7dcfd896fcaf2674f757a2463eba-Abstract.html
Southwest Airlines Co. (2023). Final summary and action plan. https://www.southwest.com/swa-resources/pdfs/corporate-commitments/SW_FinalSummary_ActionPlan_3-30.pdf
Southwest Airlines Co. (2024). 2023 annual report [Form 10-K]. https://investors.southwest.com/sec-filings/all-sec-filings/content/0000092380-24-000027/luv-20231231.htm
Tabassi, E. (2023). Artificial intelligence risk management framework (AI RMF 1.0) (NIST AI 100-1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.AI.100-1
U.S. Department of Transportation. (2023, December 18). DOT penalizes Southwest Airlines $140 million for 2022 holiday meltdown. https://www.transportation.gov/briefing-room/dot-penalizes-southwest-airlines-140-million-2022-holiday-meltdown
U.S. Department of Transportation. (2025). Southwest Airlines—Order 2025-12-4. https://www.transportation.gov/resources/individuals/aviation-consumer-protection/southwest-airlines-order-2025-12-4
U.S. Senate Committee on Commerce, Science, and Transportation. (2024). Strengthening airline operations and consumer protections: Hearing before the Committee on Commerce, Science, and Transportation, United States Senate, 118th Congress, 1st session, February 9, 2023 (S. Hrg. 118-487). U.S. Government Publishing Office. https://www.congress.gov/118/chrg/CHRG-118shrg57391/CHRG-118shrg57391.pdf
Woods, D. D. (2015). Four concepts for resilience and the implications for the future of resilience engineering. Reliability Engineering & System Safety, 141, 5–9. https://doi.org/10.1016/j.ress.2015.03.018