The Cult of the Root Cause
reinertsenassociates.com
reinertsenassociates.com
- Can you fix the crack in your hull whilst you're out at sea? Almost certainly not.
- Can you even tell you have a crack in the hull until you've reduced the water in the bilges by running the pumps for a time? Again, quite possibly not.
Treating the symptom is really the only sensible option, unless it's serious enough that you need to put out a Mayday. Again, not a course of action that addresses the root cause but, in some situations, absolutely the right thing to do. To take things up many, many notches, the sinking of the Titanic was an appalling tragedy from which relatively few people were saved, but I guarantee that nobody at all would have been saved if the people on the ship had opted for a series of committee meetings about how to solve the problem of the iceberg. (Not to say there weren't a very large number of hideous blunders in the management of that situation going all the way back to the ship's design and fit-out.)
Moreover, another problem with Five Whys is that, applied heedlessly, it's an extraordinarily arrogant philosophy, because it makes the assumption that you can know the answer to those five whys. Often you can't, at least not without going on a journey, and fixing a few things along the way, and without that, you can simply be wasting your time trying to answer questions that you can't answer in your present situation.
And that really, and somewhat poignantly, cuts to the root cause of why I view the kind of thinking frameworks/fads popular in business with a degree of scepticism: over-applied or misapplied, they paralyse people into inaction, and thereby provide fertile stock for breeding mediocrity.
I'll also agree with the "you may not be able to know a why." For systems, that can be a good guide on instrumentation to add. Sucks, in that you won't prevent the next event. Good that you should be able to get more from it.
If your damn boat is sinking, you should just get to safety ASAP, but if you're in the boat making business, it may be of some interest to know why your hulls are cracking.
Five why's is about avoiding the next case of a piece of equipment being out of alignment not the current case. You can have a reasonable policy of waiting 3 weeks before doing 5 why's so you have a better understanding of what's going on.
Why is the ship sinking? Hit an Iceburg. Why did we hit an iceburg? [Equipment or command failure] What is wrong with [maintenance strategy/command structure] that allowed this mistake to slip through? [technical details]
If you have a team of people and something goes wrong, it is overwhelmingly likely that a human could make a decision differently or do some task that is not being done that would mitigate the worst of the damage.
People absolutely are saved by the committee process, in the same way that items tend to roll downhill. Pretending that humans have perfect control over their environment and could have done something more has proven remarkably successful at getting results. It isn't very impressive, it feels very unreasonable, and it isn't going to work on its own, but it is a very useful tool to let people to stand up and ask "sure something is going on that is out of our control, so why aren't we ready for it? This happens sometimes and we need to be prepared".
Basically, if you just ask why 5 times without any sense of personal responsibility you'll get stupid results. True of any process. But if an uncontrollable event has impacted your endeavor, it is absolutely worth asking "why are we exposing ourselves to a risk we can't control? could we somehow have avoided this".
If your answer is "the relevant committee would have met before the accident" or "the committee would reduce / mitigate future accidents," you have missed GP's point.
RCA is good for figuring out how to keep others out of the mess you’re in after the fact.
5y is expensive to do right. It means that organizations with lots of failure must spend time reflecting and investigating and fixing, rather than shipping new features.
That is the point!
However, it’s still very possible to set a narrative with the five whys, because you can steer it to different contributing factors (most problems really do have more than one cause).
I frequently recommend this lecture on the Piper Alpha disaster, a fire on an offshore oil rig that killed 167 men. It eloquently summarises the findings of the Cullen Enquiry, a six month study of exactly why the disaster happened and what could be done to improve safety in the offshore industry. The enquiry found a complex and interconnected set of factors encompassing process, training, culture and design. It is densely packed with lessons that can be applied to our industry, not least of which is the idea of conducting intensive and systematic inquiries into major failures.
For a thorough and in-depth treatise on critical thinking and methods, one could read Problem Solving, Decision Making, and Professional Judgment by Paul Brest and Linda Hamilton Krieger. They provide examples of many decision making frameworks, cognitive biases, in a readable format.
I did appreciate the link to the Piper Alpha resource. For another read along these lines there is the BEA Air France 447 disaster final report. https://www.bea.aero/docspa/2009/f-cp090601.en/pdf/f-cp09060...
I dunno who taught these people about the 5 Whys, but someone (possibly themselves) has done them a tremendous disservice.
Here's what doing an exercise similar to 5 Why's gets you:
- An understanding of where issues come from. Whether your plan of action starts from the top, bottom, or middle, taking the time to step back and broaden your perspective before you jump in to fix a problem helps to make sure you're going after the right things for the right reasons.
- A culture of _not_ just picking the most expedient and facile solution every time issues come up, and going with that. In companies I've been in, the pressure is almost always on to find the dumbest, hackiest, absolutely fastest path out of trouble. Spend multiple years solving every problem that way, and you are in deep trouble! It takes institutional courage to push back against that, and having a practice in place to force you to stop and think now and again gives you an opportunity to summon that courage.
- A culture of ownership. This seems a little counterintuitive to me, since if you follow root causes deep enough you're liable to stumble onto people and process problems that are way out of your control and pay grade. Looking at root causes this way, you might think it's a process of passing the buck. However, by shining a light on such things, and finding people to address those things where they have no owner, you can push towards a better collective ownership of the real issues that face your company.
No good management idea is free from abuse, of course. You must exercise taste and judgment in deciding how deep to push with root causes, and what to do with the discoveries. I would think it's rather self-evident that 5 Why's doesn't mean you always ask exactly five questions in a strictly linear pattern. But for heaven's sake, make sure you ask more than one!
When you closely manage something to reduce variation, you also lose any information you might get about the system from the variation of that quantity. This point is nicely made in another post on the same blog: http://reinertsenassociates.com/the-dark-side-of-robustness/
Especially with reflexive systems (involving humans), the appropriate response might sometimes involve performing no intervention, or performing an intervention downstream, to modify its assumptions about what it receives (eg: adding error handling).
There’s some overlap among the following questions. The intent is to elicit observations and ideas, not to uniquely categorize them.
* What are all the factors that could have prevented the incident?
* What are all the factors that could have detected the issue before production?
* What are all the factors that could have detected the issue sooner when it did occur?
* What are all the factors that could have accelerated mitigation? (Including, especially, changes that could have reduced the risks of mitigations considered too risky to apply.)
* What are all the factors that could have accelerated remediation?
* What could have reduced the scope or impact?
It’s common to come out of this with a laundry list that overfits the last incident and, if applied, would increase the complexity of the system and add risk. We’d typically apply one or two fixes, and stockpile the rest to see if any of them would have addressed any future incident. Usually most of the “solutions” turn out to be specific to the single incident that prompted them.
The truth is that by “fixing” the root cause you will sometimes destabilize the complex system you are running.
"Post-accident attribution to a ‘root cause’ is nearly always wrong." "Post-accident remedies usually increase the coupling and complexity of the system. This increases the potential number of latent failures and also makes the detection and blocking of accident trajectories more difficult."
How Complex Systems Fail is short but loaded with value; if you haven't read it, go do so now!
It doesn't though, that's just a built-in assumption for the lazy. The point of Root Cause Analysis and the "5 Whys" isn't necessarily to get to the root and fix the root...it's to provide a framework for traversing a problem set. The point of this methodology is so that you traverse the problem, understanding each step along the way...not that you simply jump to the root and try to fix it blindly.
> shifted from pumping, to plugging, to hull repair
Pumping and plugging are immediate response, just like a decision to temporarily shut down the website when a compromise is discovered, or pulling the plug on a smoking computer. What do these have to do with root cause analysis?
That is, when your boat is sinking, immediately focusing on fixing the root cause (the crack in the hull) is not necessarily the best course of action. Instead, treat the obvious symptoms that you can to "stop the bleeding" (plug the hole, pump the water out) and you can deal with the root cause when you're in a better position to do so (back in port, not miles out to sea).
See also: metaphor.
First, I think the author is (as someone else said and as you seem to agree) raising a strawman.
Second, I don't think there are people on the other side of the argument, but there are people on the other side in situ: I mean that even if rationally they would never admit it, they hijack the immediate "fire extinguishing" or "pulling of the plug" or "pumping of water" to discuss where the problem is coming from.
I've seen those people lacking discernment, not only do they get in the way of the short-term action, they also are pretty bad at cause analysis and confound it with blaming people or "I told you so".
This is a generalization of course, but the TLDR is that even if those people wouldn't argue against it, they act against it.
Seen this everywhere. Been on both sides of this. Learned to be humble from the experience.
The irony in this, is that these non-questionable, sacred-cow like requirements, which cannot be investigated without causing sturm und drang as well as profound political problems, are often themselves, the root cause of multiple/many problems that one encounters. That you cannot investigate the entire space of issues means that there will be regions of terra incognita for your analysis.
I've seen this at every single company I've ever worked at. Including my own startup. Much of what I learned about this came from my time at SGI/Cray, where specific holy grails could not be questioned.
It is very ... very ... hard, to admit that your systems could somehow be problematic. It is tremendously humbling to see conclusive proof. It changes your engineering mind set when you do accept this, from being defensive to something better. Your architectures improve, your assumptions are less WAG-ish.
Anyway, the book is called the Spell of the Sensuous, and it's dense af, but bursting with fascinating lines of inquiry.
However, 5-whys is very useful as a design principle instead of using it to respond to failure.
It goes something like:
0: build a thing why 1: because customer asked why 2: because thing is what they think they need why 3: because it is one solution to a gap in their ability to achieve something. why 4: because that something is an economic need. why 5: because market opportunity to fill that gap with something, maybe this thing, maybe something better.
I have actually not even once encountered this 5 Why's method.
I neither heard of it before.
But I founded my company in 1996, starting out with almost two hundred years of experience surrounding my incredulous and lucky younger self, including several PhDs and former Fortune 500 board members.
I will hazard that this 5whys technique is fundamentally flawed and easily susceptible to manipulation for procuring a scapegoat.
I only hope that explains why I have never encountered this before. I hope moreso I can feel a little like somethingwas going on in the right way, in my business, to filter and reject what I think is, and definitely comes across as bogus to me.
Let's say you make light bulbs, and every fifth bulb comes out misshapen. You would use the 5 whys to trace it back to the molding station, where you discover that bulbs cool at a different rate in one of the machines because the mold uses a better insulator. You could stop there and replace the insulator. But if your job is to increase yield, then you can save the company a lot of future money if you figure out how that mold got there in the first place. You might find that purchasing subbed a cheaper replacement based on an incomplete spec. Or you might find that the supplier recently switched materials.
The point is that when you're trying to establish a controlled, repeatable process, you need to understand where your controls break down.
Once you understand the process problem, then you make a business decision about what to change. It was never meant to be applied to R&D problems. R&D processes are not as concerned with repeatedly doing something correctly. They're concerned with making sure something can be done in the first place. It's a different class of problem.
https://codeascraft.com/2016/11/17/debriefing-facilitation-g...
From the linked PDF from the article:
> “Adaptability and learning. We learn through honest, blameless reflection on lessons and surprises. We believe that traditional root cause analysis makes learning from mistakes difficult. Our blameless post-mortem process is a widely-cited technique that we believe is becoming best practice among organizations that value innovation. Blameless postmortems drive a significant percentage of our development as we analyze what about our production environment was less than optimal and rapidly make corresponding adjustments.” (Etsy, Inc., 2015)
The idea, boiled down, is to inspect timelines, procedures, and actions and develop a narrative of how an incident came to be. The goal is for everyone to walk away with a (better) understanding of everything. With this, people are better armed to put into place solutions.
One example from the text is where an engineer pushes out a change because they thought the build system had zero failures. The push breaks the system and causes a regression that should have been caught in the tests. During the postmortem, the engineer says, "I thought the tests had zero failures. I guess I need to be more diligent in the future." Upon further timeline investigation, it is noted that the tests actually had eight failures, but the font had eights and zeros looking very similar. The fix was not "be more diligent;" the fix is maybe to have a better font or use colors for pass/fail.
Overall, I like the ideas proposed in this blameless postmorem style. It runs counter to the natural tendency to "find a problem and fix it" because it feels like we are talking less about the problem and the fix and talking more about the narrative of the failure. But what I've seen is folks gaining better understanding of how everyone else works, learning about tools and tricks, and about assumptions. And knowing more about the narrative leads to better solutions.
Theirs?
Accident investigation agencies such as the AAIB and NTSB have been following "blameless" processes for decades. Find the causes and save lives. Who pressed the button or forgot to connect the oil line is irrelevant compared to the fact that the failure modes were possible.
You see this a lot in public debate like education or health care. Instead of fixing one of the many problems a lot of time and energy is wasted on finding THE root cause that will fix everything.
In cases where you can’t discover the root cause (I.e. a plane that explodes and destroys the root cause) you simply have to go as deep as is reasonable and work from there.
If someone is unwilling to be reasonable and accept a number of root causes between M-N then the issue is with them, not Root Cause Analysis.
Cause #2 is also fictitious, the 5 whys never say anything about fixing the problem, only understanding it. In fact, for me, not fixing the problem is just as valid a solution - as long as you know what caused it, you can determine if it's worth fixing it at the root or even at all.
As to the linearity of cause and effect, while it's true that many problems have multiple causes, a solution to a linear problem will prevent alternative causes below it. Besides, the grand majority of issues arising in mature systems arise from a single cause and have linear cause and effect.
http://vooza.com/videos/the-5-whys/
I doubt that most people who use the five whys really take it to be as simplistic as the author of this article suggested, but to those that do, it's a good wake up call.
In fact, life is even more complex than the article suggests, when you throw in effects of chaos, feedback loops, missing information, unknown influences - just to mention a few. Still, tracking down the order in processes has got humanity quite far (at least as far as being able to predict and engineer accordingly) so it's obviously effective.
It would’ve been better to talk about the real-world including TPMS and the NTSB investigation approach... making cars very reliable and very complex aircraft safer with strict regulations.
For applications of similar ideas to cloud software and devops-style environments, https://www.kitchensoap.com/2012/02/10/each-necessary-but-on... is also helpful!
I find that some of the toughest bugs to solve are the ones where the undesirable effect has more than one cause.
To be precise it's the kind of situation where the bug can be triggered by 2, 3 or more independent causes, i.e. each cause is sufficient on its own to cause the bug.
Often when attempting to solve a bug like that I'll find one likely cause, address it but because the bug persists, I end up undoing the fix for cause #1, then finding cause #2 and ping ponging between them till I realise that I have to address multiple causes to make the bug go away.
I'm not sure it takes us all that much further (for general purposes) than John Stuart Mill writing on causation in the nineteenth century - he did very well creating a philosophical foundation for causation-talk. (And the STPA handbook is excellent, as well.) In any case, Mill is the original source for the modern understanding plural and complex causation.
First, the 5y I've learned and run in the last 10 years takes pains to identify a fix or mitigation at each step - not just the root.
In fact for small failures and big costs, the root cause is deliberately not worked on, because analysis says the finer grain fixes are better/cheaper.
Second, root cause trees have been quite common, because there's almost never just one chain, especially when you're running a system that has plugged all the easy holes and fixed all the obvious first level problems.
Straw man article IMO, but I can't figure out for what purpose.
Nothing to see here.
A few of the things:
1. It shows visibility about the engineer's abilities
2. It attempts to show weaknesses of technology choices that happen above the people who support it
3. It attempts to show a weakness in the process. (Similar to a retro) Yet, in practice, rarely is this addressed.
The answer to the last question should instead be on or many of: no unit tests, no code reviews, working overtime, no QA before shipping, can't concentrate in open landscape, compiler warnings disabled, using too low-level programming language for high level logic, developers not educated on current tech stack, and so on. With follow up whys on all of those.