It's a good overall plan C.

But why does the data link itself have no fallback? An important data link should have multiple dissimilar backups.

> why does the data link itself have no fallback?

It's Gatwick, not Heathrow. Whiteboards are good enough. If every airport the size of Gatwick (and busier) implemented digital fallbacks, I wouldn't be surprised if the fallbacks took out the primary system more often than external causes. (I can’t remember the last time I used those screens over my phone. In a certain sense, the screens are now a backup.)

More precisely, if you consider the number of situations which (a) take down the primary system but (b) don't take out the airport, and try to cover those as cheaply and robustly as possible, for all but the world's busiest airports you come up with whiteboards. Localised power failure? Whiteboards. Surge? Whiteboards. Limited fire or flooding? Whiteboards. Fibre-optic cable gets nicked? Whiteboards or alternative digital system. Now compare the costs and risks of the digital system. Whiteboards are the work of a smart operator who probably saved their airport years of technical debt.

Gatwick is still a major airport, the 8th biggest in Europe or the 33rd at in the world.

The evidence is that whiteboards are ok, but with their location a second fibre link would not be difficult.

It sounds good in theory, but the practice is different.

“High availability” database measures are often less reliable than the normal, simpler approach.

Automated network failover equipment often causes more downtime than having multiple links and only failing over manually, or even depending on a single link.

Complexity is the enemy of robustness.

System failure is not just one simple category with known behaviours; different types of failures affect performance in different ways, and it’s hard to support all of them well. Just as exception-handling code is commonly the buggiest code out there, high-availability measures are commonly some of the most fragile parts out there, unintentionally causing more problems than they solve. They can be made robust, but it takes a lot of effort to do so, and frankly it’s seldom justifiable. Typically, simplicity is good. Definitely it’s easier to debug.

> Automated network failover equipment often causes more downtime than having multiple links and only failing over manually, or even depending on a single link.

Failing over manually sounds fine. If they can't swap over at all then that's a sign of fragility which will cause its own problems.

Well you also need to have people run around and update them.

Whats wrong with that? It seems to have worked. Sure not ideal, but better than canceling flights and shutting down the airport.

Obviously it’s better than shutting down the airport. But is it better than the alternatives Someone1234 proposed? That was the question.

I don't have the data of course but it does seem better. Those alternative are pretty expensive to build and maintain, have to be tested regularly and are prone to failure. For a situation that has a very low probability of happening, whiteboards do seem more reasonable, that's a very lean approach!

The chance of a single fiber line getting cut is not "very low", it's something that a big entity should expect to happen. Much like a power outage; I'm sure they have very good plans for that case. An extra modem is cheap as dirt.

Not saying there was anything wrong with it. The people who came in during their off hours to update whiteboards for however many hours are the real heroes of this operation.

That said it was probably very expensive :P

Theres a lot of fawning over the humble whiteboard here, just wanted to emphasize that they were part of a larger scheme