This document discusses various approaches to analyzing system failures and outages, including root cause analysis. It notes that sequence-of-events analysis can oversimplify issues and ignore surrounding context. Epidemiological models that view failures as resulting from the alignment of multiple factors are preferable. Truly understanding failures requires examining how organizational, technical, and human factors interact as a complex system over time.

1. Outages,
Post-Mortems,
and Human Error 101
John Allspaw
SVP, Tech Ops

2. Science
TimeTravel
Mythbusting
Reading
Homework

3. Here To Challenge You

4. Resilience
Engineering
Dr. Erik Hollnagel Dr. David Woods Dr. Sidney Dekker Dr. Richard Cook

5. COMPLEX
+
DYNAMIC

6. COMPLEX
!=
COMPLICATED

7. Fundamental
Surprises

8. E.T.T.O.
Efficiency Thoroughness

10. Organizations, Policies, Procedures,
Regulations
BLUNT
Resources & Constraints

11. Organizations, Policies, Procedures,
Regulations
BLUNT
Resources & Constraints
Slips Adjustments
Operators
Compensations Mistakes
Lapses Recoveries
Violations Improvisations
SHARP

12. FUTURE
+
PAST

13. Why Do Them?

14. Why?
Understand the FAILURE

15. Why?
Understand the SYSTEM

16. Where “System” =
Networks
Servers
Applications
Processes
People

17. Where “System” =
Networks
Servers
Applications
Processes
People

18. PEOPLE

20. (Anticipation)
Knowing
What
To Expect

21. (Anticipation)
Knowing Knowing
What What
To Expect To Look For
(Monitoring)

22. (Anticipation) (Response)
Knowing Knowing Knowing
What What What
To Expect To Look For To Do
(Monitoring)

23. (Anticipation) (Response)
Knowing Knowing Knowing Knowing
What What What What
To Expect To Look For To Do Has Happened
(Monitoring) (Learning)

24. (Anticipation) (Response)
Knowing Knowing Knowing Knowing
What What What What
To Expect To Look For To Do Has Happened
(Monitoring) (Learning)

25. Microphones are ON?

27. Event Awareness
Code Deploys

29. Timeline
RICH DATA

30. Traces of
Data
Timeline
RICH DATA

31. Status
Blog
Twitter
Feed

32. Flight Data
Recorder

34. Annotation Traces

35. Investigation
Basics

36. Start?

37. TTD
How?

38. TTR

39. Stable
(“all clear”)

40. Impact Time = TTR - Start

41. SEVERITY

42. SEV 1
A. Total loss of service
B. Severe degradation, effectively unusable
C. Loss of a critical feature

43. SEV 2
A. Major degradation/feature loss for SUBSET of members
B. Minor degradation/feature loss for ALL members

44. SEV 3
Noticeable
non-critical feature loss or degradation

45. SEV 4
No visible impact, loss of redundancy or capacity
headroom

46. SEV 5
No-impact but unexpected failure

47. 5/11/2011 - Payments/Checkout system issue
Start 4:10pm
TTD 4:15pm
TTR 4:30pm
Stable 4:35pm
Total Impact 20 min
Severity 1

48. Basic metrics
Timeline with details
Remediations/Observations

49. “normal”
Incident PostMortem
operation
Time

50. How?
Why?
Prevention?

51. How

52. Crisis Patterns
Problem Starts
PostMortem
Time

53. Crisis Patterns
Problem Starts
Detection
PostMortem
Time

54. Crisis Patterns
Problem Starts
Detection
Evaluation
PostMortem
Time

55. Crisis Patterns
Problem Starts
Detection
Evaluation
Response
PostMortem
Time

56. Crisis Patterns
Problem Starts
Detection
Evaluation
Response
Stable
PostMortem
Time

57. Crisis Patterns
Problem Starts
Detection
Evaluation
Response
Stable
PostMortem
Confirmation
Time

58. Crisis Patterns
Problem Starts
Detection
Evaluation
Response
Stable
PostMortem
Confirmation
All Clear
Time

59. Crisis Patterns
Problem Starts
Stress
Detection
Evaluation
Response
Stable
PostMortem
Confirmation
All Clear
Time

60. Crisis Patterns
Problem Starts
PostMortem
Time

61. Crisis Patterns
Problem Starts
Detection
PostMortem
Time

62. Crisis Patterns
Problem Starts
Detection Evaluation
PostMortem
Time

63. Crisis Patterns
Problem Starts
Detection Evaluation
Response
PostMortem
Time

64. Crisis Patterns
Problem Starts
Detection Evaluation
Response
Stable
PostMortem
Time

65. Crisis Patterns
Problem Starts
Detection Evaluation
Response
Stable
PostMortem
Confirmation
Time

66. Crisis Patterns
Problem Starts
Detection Evaluation
Response
Stable
PostMortem
Confirmation
All Clear
Time

67. Crisis Patterns
Problem Starts Stress
Detection Evaluation
Response
Stable
PostMortem
Confirmation
All Clear
Time

68. Crisis Patterns
Problem Starts
PostMortem
Time

69. Crisis Patterns
Problem Starts
Detection
PostMortem
Time

70. Crisis Patterns
Problem Starts
Detection
Evaluation
PostMortem
Time

71. Crisis Patterns
Problem Starts
Detection
Evaluation
Response
PostMortem
Time

72. Crisis Patterns
Problem Starts
Detection
Evaluation
Response
Stable
PostMortem
Time

73. Crisis Patterns
Problem Starts
Detection
Evaluation
Response
Stable
PostMortem
Confirmation
Time

74. Crisis Patterns
Problem Starts
Detection
Evaluation
Response
Stable
PostMortem
Confirmation
All Clear
Time

75. Crisis Patterns
Problem Starts Stress
Detection
Evaluation
Response
Stable
PostMortem
Confirmation
All Clear
Time

76. Problem Starts
Detection
Evaluation
Response
Stable
PostMortem
Confirmation
All Clear
Time

77. Problem Starts
Detection
Evaluation
Response
Stable
PostMortem
Confirmation
All Clear
Time

78. Problem Starts
Detection
Evaluation
Response
Stable
PostMortem
Confirmation
All Clear
Time
Internal and External Update Communications

79. Crisis Patterns
Problem Starts
Detection
Evaluation
Response
Stable
Confirmation
All Clear
Time

80. Crisis Patterns

81. Crisis Patterns
Forced beyond learned roles

82. Crisis Patterns
Forced beyond learned roles
Actions whose consequences are both important and
difficult to see

83. Crisis Patterns
Forced beyond learned roles
Actions whose consequences are both important and
difficult to see
Cognitively and perceptively noisy

84. Crisis Patterns
Forced beyond learned roles
Actions whose consequences are both important and
difficult to see
Cognitively and perceptively noisy
Coordinative load increases exponentially

85. Thematic Vagabonding
“butterfly minds”
NOT STUCK ENOUGH

86. Goal Fixation
(encystment)
TOO STUCK

87. Heroism
Non-communicating lone wolf-isms

88. Distraction
Irrelevant noise in comm channels

89. IMPROVISATION
REQUIREMENT for troubleshooting
complex systems

90. IMPROVISATION

91. IMPROVISATION

92. Why?

93. Root Cause Analysis
“With the unknown, one is confronted with danger,
discomfort, and care; the first instinct is to abolish
these painful states.
First principle: any explanation is better than
none.”
Friedrich Nietzsche
Twilight of the Idols, or
How to Philosophize with a Hammer

94. Hindsight Bias
Knowledge of the outcome influences the
analysis of the process
Makes steps towards failure appear
foreseeable and obvious

95. After The Fact

96. After The Fact

97. Reality: Before and During

98. Hindsight Bias
“Should have known better”
“All the signs were there, you just needed to
pay attention”

99. Hindsight Bias
BEFORE accident:
The future seems implausible
AFTER accident:
Obviously clear: “how could they not see what
mistake they were about to make?!”

100. Hindsight Bias
“...people’s need to be right
is stronger than their ability
to be objective.”
N. Crawford
American Psychological Association

101. Outcome Bias
Judging a past decision
based on its outcome.

102. ID Fishbone/Ishikawa
FMEA
Five Whys
Fault Tree CED
CRT

103. why?
OUTAGE

104. why?
because
this
OUTAGE

105. why? why?
because
this
OUTAGE

106. why? why?
because because
this this
OUTAGE

107. why? why? why?
because because
this this
OUTAGE

108. why? why? why?
because because because
this this this
OUTAGE

109. why? why? why?
because because because
this this this
OUTAGE
but: WHY?

110. which
caused
Some Caused other
Action Some Things things
OUTAGE
to
happen

111. Sequence-Of-Events

113. • Satisfyingly simple, easy to explain and document

114. • Satisfyingly simple, easy to explain and document
• Solves for a specific case
• Ignorant of surrounding circumstances
• Too focused on components
• Validates Hindsight and Outcome bias

115. NOT HELPFUL
• Satisfyingly simple, easy to explain and document
• Solves for a specific case
• Ignorant of surrounding circumstances
• Too focused on components
• Validates Hindsight and Outcome bias

116. Epidemiological
(adapted from Reason, 1990)

117. (adapted from Reason, 1990)

118. Holes = Active/Latent Failures,
Bad Things™ Waiting to Happen
(adapted from Reason, 1990)

119. Holes = Active/Latent Failures,
Bad Things™ Waiting to Happen
Cheese = Safety Barriers,
Layers of Defense (adapted from Reason, 1990)

120. (adapted from Reason, 1990)

121. Code Servers
(adapted from Reason, 1990)

122. Code Servers
Schedule Training (adapted from Reason, 1990)

124. Unmonitored Disk Space
(latent condition)

125. Capacity
Unmonitored Disk Space
Miscalculation
(latent condition)
(latent condition)

126. Capacity
Unmonitored Disk Space
Miscalculation
(latent condition)
(latent condition)
Unit Test In
Transition

127. Violation of known coding
Capacity standards Unmonitored Disk Space
Miscalculation (latent condition) (latent condition)
(latent condition)
Unit Test In
Transition

128. Violation of known coding
Capacity standards Unmonitored Disk Space
Miscalculation (latent condition) (latent condition)
(latent condition)
Unit Test In
Bug Introduced
Transition
(active failure)

129. Violation of known coding
Capacity standards Unmonitored Disk Space
Miscalculation (latent condition) (latent condition)
(latent condition)
Unit Test In
Bug Introduced External API call
Transition
(active failure) (active failure)

130. Violation of known coding
Capacity standards Unmonitored Disk Space
Miscalculation (latent condition) (latent condition)
(latent condition)
Unit Test In
Bug Introduced External API call
Transition
(active failure) (active failure)

131. Violation of known coding
Capacity standards Unmonitored Disk Space
Miscalculation (latent condition) (latent condition)
(latent condition)
Unit Test In
Bug Introduced External API call
Transition
(active failure) (active failure)

132. Violation of known coding
Capacity standards Unmonitored Disk Space
Miscalculation (latent condition) (latent condition)
(latent condition)
Unit Test In
Bug Introduced External API call
Transition
(active failure) (active failure)

133. Violation of known coding
Capacity standards Unmonitored Disk Space
Miscalculation (latent condition) (latent condition)
(latent condition)
Unit Test In
Bug Introduced External API call
Transition
(active failure) (active failure)

134. Violation of known coding
Capacity standards Unmonitored Disk Space
Miscalculation (latent condition) (latent condition)
(latent condition)
Unit Test In
Bug Introduced External API call
Transition
(active failure) (active failure)

135. Violation of known coding
Capacity standards Unmonitored Disk Space
Miscalculation (latent condition) (latent condition)
(latent condition)
Unit Test In
Bug Introduced External API call
Transition
(active failure) (active failure)

136. Violation of known coding
Capacity standards Unmonitored Disk Space
Miscalculation (latent condition) (latent condition)
(latent condition)
Unit Test In
Bug Introduced External API call
Transition
(active failure) (active failure)
FAILURE!

137. Capacity
Miscalculation
(latent condition)
Unit Test In
Bug Introduced External API call
Transition
(active failure) (active failure)

138. Capacity
Miscalculation
(latent condition)
Unit Test In
Bug Introduced External API call
Transition
(active failure) (active failure)

139. Capacity
Miscalculation
(latent condition)
Unit Test In
Bug Introduced External API call
Transition
(active failure) (active failure)

140. Capacity
Miscalculation
(latent condition)
Unit Test In
Bug Introduced External API call
Transition
(active failure) (active failure)
NO FAILURE!

142. • Better than dominoes, but still linear layers of “defense”
• Helps uncover multiple contributors and latent failures (at
sharp and blunt ends)

143. • Better than dominoes, but still linear layers of “defense”
• Helps uncover multiple contributors and latent failures (at
sharp and blunt ends)
• Doesn’t explain lineups or orientation of holes
• Only identifies defects/gaps, nothing more
• Still encourages judgements of decisions

144. Better, but still
NOT HELPFUL
• Better than dominoes, but still linear layers of “defense”
• Helps uncover multiple contributors and latent failures (at
sharp and blunt ends)
• Doesn’t explain lineups or orientation of holes
• Only identifies defects/gaps, nothing more
• Still encourages judgements of decisions

145. Multiple Contributors
“each necessary but only jointly sufficient”

146. Resultant Versus Emergent

147. Systemic
Database
Router Memcache
Webserver

148. Systemic
Database
Router Memcache
Webserver
Feature
Roadmap

149. Systemic
Database
Router Memcache
Last Round
Webserver of Funding
Feature
Roadmap

150. Systemic Dashboard
Design
Database
Router Memcache
Last Round
Webserver of Funding
Feature
Roadmap

151. Systemic Dashboard
Design
Database
Router Memcache
Last Round
Webserver of Funding
Feature
Roadmap
DBA’s car

152. Systemic Dashboard
Design
Database
Router Memcache
Last Round
Webserver of Funding
Feature
Roadmap
No Eng
DBA’s car Training

153. Systemic Dashboard
Design
Database
Router Memcache
Last Round
Webserver of Funding
Feature
Email is
Roadmap
down
No Eng
DBA’s car Training

154. Systemic Dashboard
Design
Database
Router Memcache
Last Round
Webserver of Funding
Feature
Email is
Roadmap
down
Entire
Ops Team
No Eng Is At
DBA’s car Training Velocity

155. Systemic Dashboard
Design
Database
Router Memcache
Last Round
Webserver of Funding
Feature
Email is
Roadmap
down
Entire
Ops Team
No Eng Techcrunch Is At
DBA’s car Training Article Velocity

156. Systemic Hiring
Dashboard
Design
Difficulties Database
Router Memcache
Last Round
Webserver of Funding
Feature
Email is
Roadmap
down
Entire
Ops Team
No Eng Techcrunch Is At
DBA’s car Training Article Velocity

157. Systemic Hiring
S3 is slow Dashboard
Design
Difficulties Database
Router Memcache
Last Round
Webserver of Funding
Feature
Email is
Roadmap
down
Entire
Ops Team
No Eng Techcrunch Is At
DBA’s car Training Article Velocity

158. Systemic Hiring
S3 is slow Dashboard
Design
Difficulties Database
Router Memcache
Last Round
Webserver of Funding
Feature
Email is
Roadmap
down
Entire
Ops Team
No Eng Techcrunch Is At
DBA’s car Training Article Velocity

159. Systemic

160. Systemic

161. Systemic

162. Systemic

163. Systemic

164. Systemic

165. Systemic

166. Functional Resonance
In isolation, components act within bounds.
Interconnected, they produce emerging
behaviors.

167. Causes Are Constructed,
Not Found
WYLFIWYF
Pre-conceived notions on “causes” and behaviors

168. Contributors, not causes

169. There is no root cause.

170. LEARNING

171. Quantifying Response
Time to detect?
Time for escalation, internal notification?
Time to notify the public?
Time to graceful degradation? (feature off)
Time to stable/resolve?
Time to all clear?

172. Qualifying Response
High signal:noise in comm channels?
Troubleshooting fatigue?
Troubleshooting handoff?
All tools on-hand?
Metrics visibility?
Collaborative and skillful communication?
Improvised tooling or solutions?

173. All Together Now
• Start/TTD/TTR/Stable/etc.
• Severity
• DATA (graphs, IRC, etc.)
• Description (timeline, etc.)
• Observations (motivations, latent conditions, etc.)
• Actions (remediation tickets, followup)

174. (Anticipation) (Response)
Knowing Knowing Knowing Knowing
What What What What
To Expect To Look For To Do Has Happened
(Monitoring) (Learning)

175. (Anticipation) (Response)
Knowing Knowing Knowing Knowing
What What What What
To Expect To Look For To Do Has Happened
(Monitoring) (Learning)

176. Human Error
“...knowledge and error flow from the
same mental sources, only success
can tell one from the other.”
Ernest Mach, 1905

177. Human Error
Nobody comes to work to do a bad job.

178. Human Error
Useless as a label and ending point.

179. Human Error
Human error isn’t a cause, it’s
an effect.

180. Why did it make sense
to the person
at the time?

181. Error Categories
• Slips
• Lapses
• Mismatches
• Violations

182. Error Categories

183. First Stories
“Human error” seen as root cause.
Counterfactuals: saying what they “should”
have done.
Prevention: be “more careful!”

184. Second Stories
“Human error” seen as systemic vulnerabilities,
deeper inside the organization.
Digging into why it made sense for them to do what they
did, at the time they did it.
Prevention...

185. Why did it make sense
to the person
at the time?

186. Why did it make sense
to the person
at the time?

187. Why did it make sense
to the person
at the time?

188. Substitution Test
Could peers have made the
same error under the same
circumstances?

189. Near Misses
Hey everybody -
Don’t be like me. I tried to X, but
because it was no good.
It almost exploded everyone.
So, don’t do: (details about X)
Love,
Joe

190. WHERE to learn from ?

191. Two Propositions

192. 100 deploys
6 deploy-related issues

193. 100 > 6

194. Proposition #1
“Ways in which things go right are special cases
of the ways in which things go wrong.”

195. Proposition #1
Successes = failures gone wrong
Study the failures, generalize from that.
6 100
data sources: out of

196. Proposition #2
“Ways in which things go wrong are special
cases of the ways in which things go right.”

197. Proposition #2
Failures = successes gone wrong
Study the successes, generalize from that
data sources: 94 out of 100

198. 94/100 ?
OR
6/100 ?

199. What and WHY Do Things
Go RIGHT?

200. Not just:
why did we fail?
But also:
why did we succeed?

201. Taking the New View
Recognize that human error is
an attribution.

202. Taking the New View
Pursue Second Stories.

203. Taking the New View
Escape Hindsight Bias.

204. Taking the New View
Understand work as performed
at the sharp end.

205. Taking the New View
Examine how changes (at all
layers) will produce new
vulnerabilities.

206. Taking the New View
Use technology to support and
enhance human expertise.

207. Taking the New View
Tame complexity through new
forms of feedback.

208. Taking the New View
Realize that your systems are
not inherently safe.

209. Taking the New View
Human error is an inevitable
by-product of strained
complex systems.

210. Taking the New View
Human error isn’t at the root of
your safety problems.

211. Taking the New View
Human error isn’t random.

212. (Anticipation) (Response)
Knowing Knowing Knowing Knowing
What What What What
To Expect To Look For To Do Has Happened
(Monitoring) (Learning)

214. Just Culture

215. Just Culture
Balancing accountability with
learning.

216. Intentional Malice

217. Negligence
Found
Severity of the Outage

218. Name
Blame
Shame

219. Name
Blame
Shame

220. Name
WHY?
Blame
#!@%$&#
Shame

221. “Must set an example!”

222. “Has to be some fear that not
doing one’s job correctly could
lead to punishment.”

223. “Must set an example!”
Punishing
Deterrents is a not
“Has to be some fear that
Losing could
doing one’s job correctly
Proposition
lead to punishment.”

224. Holding People Accountable
!=
Blaming People

225. Accountability
and
Learning
Punishment For Errors

226. No Bad Apples
Only Bad Theories of Error

227. Name
WHY?
Blame
#!@%$&#
Shame

228. Signs Of Old View
“Gross Misconduct”
“Carelessness”
“Negligence”
“Egregious Behavior”
“Willful Violations”

229. Discretionary Spaces

230. Acceptable
Unacceptable

231. Acceptable
Unacceptable

232. Acceptable
Unacceptable

233. Acceptable
Unacceptable

234. Acceptable
(who draws this subjective line?)
Unacceptable

235. Increase Accountability By
Supporting Learning

236. Empower People
Let them own their own stories.
Don’t make people pay penalties.
Allow them to educate the organization.

237. Reduce Uncertainty
Make it clear who defines
acceptable behavior.

238. Organizational Roots
Accountability =
Responsibility + Requisite Authority

239. (Anticipation) (Response)
Knowing Knowing Knowing Knowing
What What What What
To Expect To Look For To Do Has Happened
(Monitoring) (Learning)

241. (Thanks, Fellas)
Dr. Erik Hollnagel Dr. David Woods Dr. Sidney Dekker Dr. Richard Cook

242. Homework!

243. THE
END

244. •
Photo Credits
http://www.flickr.com/photos/51035644987@N01/2678090600/
• http://www.flickr.com/photos/67196253@N00/2941655917/
• http://www.flickr.com/photos/stirwise/417629641
• http://www.flickr.com/photos/38383999@N06/3888057995/
• http://www.flickr.com/photos/94443490@N00/361543080/
• http://www.flickr.com/photos/7729940@N06/4333396494/
• http://www.flickr.com/photos/cpstorm/167418602
• http://www.flickr.com/photos/63474264@N00/4366221069/
• http://www.flickr.com/photos/proimos/4199675334
• http://www.flickr.com/photos/30475691@N07/2862060992/
• http://www.flickr.com/photos/14663487@N00/797755046/
• http://www.flickr.com/photos/25080113@N06/5361445631/