Outages, PostMortems, and Human Error
•
13 likes•36,003 views
This document discusses various approaches to analyzing system failures and outages, including root cause analysis. It notes that sequence-of-events analysis can oversimplify issues and ignore surrounding context. Epidemiological models that view failures as resulting from the alignment of multiple factors are preferable. Truly understanding failures requires examining how organizational, technical, and human factors interact as a complex system over time.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
More from John Allspaw
More from John Allspaw (14)
Recently uploaded
Recently uploaded (20)
Outages, PostMortems, and Human Error
- 1. Outages, Post-Mortems, and Human Error 101 John Allspaw SVP, Tech Ops
- 3. Here To Challenge You
- 4. Resilience Engineering Dr. Erik Hollnagel Dr. David Woods Dr. Sidney Dekker Dr. Richard Cook
- 5. COMPLEX + DYNAMIC
- 6. COMPLEX != COMPLICATED
- 8. E.T.T.O. Efficiency Thoroughness
- 10. Organizations, Policies, Procedures, Regulations BLUNT Resources & Constraints
- 11. Organizations, Policies, Procedures, Regulations BLUNT Resources & Constraints Slips Adjustments Operators Compensations Mistakes Lapses Recoveries Violations Improvisations SHARP
- 12. FUTURE + PAST
- 13. Why Do Them?
- 16. Where “System” = Networks Servers Applications Processes People
- 17. Where “System” = Networks Servers Applications Processes People
- 18. PEOPLE
- 20. (Anticipation) Knowing What To Expect
- 21. (Anticipation) Knowing Knowing What What To Expect To Look For (Monitoring)
- 22. (Anticipation) (Response) Knowing Knowing Knowing What What What To Expect To Look For To Do (Monitoring)
- 23. (Anticipation) (Response) Knowing Knowing Knowing Knowing What What What What To Expect To Look For To Do Has Happened (Monitoring) (Learning)
- 24. (Anticipation) (Response) Knowing Knowing Knowing Knowing What What What What To Expect To Look For To Do Has Happened (Monitoring) (Learning)
- 29. Timeline RICH DATA
- 30. Traces of Data Timeline RICH DATA
- 32. Flight Data Recorder
- 36. Start?
- 37. TTD How?
- 38. TTR
- 40. Impact Time = TTR - Start
- 41. SEVERITY
- 42. SEV 1 A. Total loss of service B. Severe degradation, effectively unusable C. Loss of a critical feature
- 43. SEV 2 A. Major degradation/feature loss for SUBSET of members B. Minor degradation/feature loss for ALL members
- 44. SEV 3 Noticeable non-critical feature loss or degradation
- 45. SEV 4 No visible impact, loss of redundancy or capacity headroom
- 46. SEV 5 No-impact but unexpected failure
- 47. 5/11/2011 - Payments/Checkout system issue Start 4:10pm TTD 4:15pm TTR 4:30pm Stable 4:35pm Total Impact 20 min Severity 1
- 48. Basic metrics Timeline with details Remediations/Observations
- 49. “normal” Incident PostMortem operation Time
- 51. How
- 52. Crisis Patterns Problem Starts PostMortem Time
- 53. Crisis Patterns Problem Starts Detection PostMortem Time
- 54. Crisis Patterns Problem Starts Detection Evaluation PostMortem Time
- 55. Crisis Patterns Problem Starts Detection Evaluation Response PostMortem Time
- 56. Crisis Patterns Problem Starts Detection Evaluation Response Stable PostMortem Time
- 57. Crisis Patterns Problem Starts Detection Evaluation Response Stable PostMortem Confirmation Time
- 58. Crisis Patterns Problem Starts Detection Evaluation Response Stable PostMortem Confirmation All Clear Time
- 59. Crisis Patterns Problem Starts Stress Detection Evaluation Response Stable PostMortem Confirmation All Clear Time
- 60. Crisis Patterns Problem Starts PostMortem Time
- 61. Crisis Patterns Problem Starts Detection PostMortem Time
- 62. Crisis Patterns Problem Starts Detection Evaluation PostMortem Time
- 63. Crisis Patterns Problem Starts Detection Evaluation Response PostMortem Time
- 64. Crisis Patterns Problem Starts Detection Evaluation Response Stable PostMortem Time
- 65. Crisis Patterns Problem Starts Detection Evaluation Response Stable PostMortem Confirmation Time
- 66. Crisis Patterns Problem Starts Detection Evaluation Response Stable PostMortem Confirmation All Clear Time
- 67. Crisis Patterns Problem Starts Stress Detection Evaluation Response Stable PostMortem Confirmation All Clear Time
- 68. Crisis Patterns Problem Starts PostMortem Time
- 69. Crisis Patterns Problem Starts Detection PostMortem Time
- 70. Crisis Patterns Problem Starts Detection Evaluation PostMortem Time
- 71. Crisis Patterns Problem Starts Detection Evaluation Response PostMortem Time
- 72. Crisis Patterns Problem Starts Detection Evaluation Response Stable PostMortem Time
- 73. Crisis Patterns Problem Starts Detection Evaluation Response Stable PostMortem Confirmation Time
- 74. Crisis Patterns Problem Starts Detection Evaluation Response Stable PostMortem Confirmation All Clear Time
- 75. Crisis Patterns Problem Starts Stress Detection Evaluation Response Stable PostMortem Confirmation All Clear Time
- 76. Problem Starts Detection Evaluation Response Stable PostMortem Confirmation All Clear Time
- 77. Problem Starts Detection Evaluation Response Stable PostMortem Confirmation All Clear Time
- 78. Problem Starts Detection Evaluation Response Stable PostMortem Confirmation All Clear Time Internal and External Update Communications
- 79. Crisis Patterns Problem Starts Detection Evaluation Response Stable Confirmation All Clear Time
- 80. Crisis Patterns
- 81. Crisis Patterns Forced beyond learned roles
- 82. Crisis Patterns Forced beyond learned roles Actions whose consequences are both important and difficult to see
- 83. Crisis Patterns Forced beyond learned roles Actions whose consequences are both important and difficult to see Cognitively and perceptively noisy
- 84. Crisis Patterns Forced beyond learned roles Actions whose consequences are both important and difficult to see Cognitively and perceptively noisy Coordinative load increases exponentially
- 85. Thematic Vagabonding “butterfly minds” NOT STUCK ENOUGH
- 86. Goal Fixation (encystment) TOO STUCK
- 88. Distraction Irrelevant noise in comm channels
- 90. IMPROVISATION
- 91. IMPROVISATION
- 92. Why?
- 93. Root Cause Analysis “With the unknown, one is confronted with danger, discomfort, and care; the first instinct is to abolish these painful states. First principle: any explanation is better than none.” Friedrich Nietzsche Twilight of the Idols, or How to Philosophize with a Hammer
- 94. Hindsight Bias Knowledge of the outcome influences the analysis of the process Makes steps towards failure appear foreseeable and obvious
- 95. After The Fact
- 96. After The Fact
- 97. Reality: Before and During
- 98. Hindsight Bias “Should have known better” “All the signs were there, you just needed to pay attention”
- 99. Hindsight Bias BEFORE accident: The future seems implausible AFTER accident: Obviously clear: “how could they not see what mistake they were about to make?!”
- 100. Hindsight Bias “...people’s need to be right is stronger than their ability to be objective.” N. Crawford American Psychological Association
- 101. Outcome Bias Judging a past decision based on its outcome.
- 102. ID Fishbone/Ishikawa FMEA Five Whys Fault Tree CED CRT
- 103. why? OUTAGE
- 104. why? because this OUTAGE
- 105. why? why? because this OUTAGE
- 106. why? why? because because this this OUTAGE
- 107. why? why? why? because because this this OUTAGE
- 108. why? why? why? because because because this this this OUTAGE
- 109. why? why? why? because because because this this this OUTAGE but: WHY?
- 110. which caused Some Caused other Action Some Things things OUTAGE to happen
- 111. Sequence-Of-Events
- 113. • Satisfyingly simple, easy to explain and document
- 114. • Satisfyingly simple, easy to explain and document • Solves for a specific case • Ignorant of surrounding circumstances • Too focused on components • Validates Hindsight and Outcome bias
- 115. NOT HELPFUL • Satisfyingly simple, easy to explain and document • Solves for a specific case • Ignorant of surrounding circumstances • Too focused on components • Validates Hindsight and Outcome bias
- 116. Epidemiological (adapted from Reason, 1990)
- 117. (adapted from Reason, 1990)
- 118. Holes = Active/Latent Failures, Bad Things™ Waiting to Happen (adapted from Reason, 1990)
- 119. Holes = Active/Latent Failures, Bad Things™ Waiting to Happen Cheese = Safety Barriers, Layers of Defense (adapted from Reason, 1990)
- 120. (adapted from Reason, 1990)
- 121. Code Servers (adapted from Reason, 1990)
- 122. Code Servers Schedule Training (adapted from Reason, 1990)
- 124. Unmonitored Disk Space (latent condition)
- 125. Capacity Unmonitored Disk Space Miscalculation (latent condition) (latent condition)
- 126. Capacity Unmonitored Disk Space Miscalculation (latent condition) (latent condition) Unit Test In Transition
- 127. Violation of known coding Capacity standards Unmonitored Disk Space Miscalculation (latent condition) (latent condition) (latent condition) Unit Test In Transition
- 128. Violation of known coding Capacity standards Unmonitored Disk Space Miscalculation (latent condition) (latent condition) (latent condition) Unit Test In Bug Introduced Transition (active failure)
- 129. Violation of known coding Capacity standards Unmonitored Disk Space Miscalculation (latent condition) (latent condition) (latent condition) Unit Test In Bug Introduced External API call Transition (active failure) (active failure)
- 130. Violation of known coding Capacity standards Unmonitored Disk Space Miscalculation (latent condition) (latent condition) (latent condition) Unit Test In Bug Introduced External API call Transition (active failure) (active failure)
- 131. Violation of known coding Capacity standards Unmonitored Disk Space Miscalculation (latent condition) (latent condition) (latent condition) Unit Test In Bug Introduced External API call Transition (active failure) (active failure)
- 132. Violation of known coding Capacity standards Unmonitored Disk Space Miscalculation (latent condition) (latent condition) (latent condition) Unit Test In Bug Introduced External API call Transition (active failure) (active failure)
- 133. Violation of known coding Capacity standards Unmonitored Disk Space Miscalculation (latent condition) (latent condition) (latent condition) Unit Test In Bug Introduced External API call Transition (active failure) (active failure)
- 134. Violation of known coding Capacity standards Unmonitored Disk Space Miscalculation (latent condition) (latent condition) (latent condition) Unit Test In Bug Introduced External API call Transition (active failure) (active failure)
- 135. Violation of known coding Capacity standards Unmonitored Disk Space Miscalculation (latent condition) (latent condition) (latent condition) Unit Test In Bug Introduced External API call Transition (active failure) (active failure)
- 136. Violation of known coding Capacity standards Unmonitored Disk Space Miscalculation (latent condition) (latent condition) (latent condition) Unit Test In Bug Introduced External API call Transition (active failure) (active failure) FAILURE!
- 137. Capacity Miscalculation (latent condition) Unit Test In Bug Introduced External API call Transition (active failure) (active failure)
- 138. Capacity Miscalculation (latent condition) Unit Test In Bug Introduced External API call Transition (active failure) (active failure)
- 139. Capacity Miscalculation (latent condition) Unit Test In Bug Introduced External API call Transition (active failure) (active failure)
- 140. Capacity Miscalculation (latent condition) Unit Test In Bug Introduced External API call Transition (active failure) (active failure) NO FAILURE!
- 142. • Better than dominoes, but still linear layers of “defense” • Helps uncover multiple contributors and latent failures (at sharp and blunt ends)
- 143. • Better than dominoes, but still linear layers of “defense” • Helps uncover multiple contributors and latent failures (at sharp and blunt ends) • Doesn’t explain lineups or orientation of holes • Only identifies defects/gaps, nothing more • Still encourages judgements of decisions
- 144. Better, but still NOT HELPFUL • Better than dominoes, but still linear layers of “defense” • Helps uncover multiple contributors and latent failures (at sharp and blunt ends) • Doesn’t explain lineups or orientation of holes • Only identifies defects/gaps, nothing more • Still encourages judgements of decisions
- 145. Multiple Contributors “each necessary but only jointly sufficient”
- 147. Systemic Database Router Memcache Webserver
- 148. Systemic Database Router Memcache Webserver Feature Roadmap
- 149. Systemic Database Router Memcache Last Round Webserver of Funding Feature Roadmap
- 150. Systemic Dashboard Design Database Router Memcache Last Round Webserver of Funding Feature Roadmap
- 151. Systemic Dashboard Design Database Router Memcache Last Round Webserver of Funding Feature Roadmap DBA’s car
- 152. Systemic Dashboard Design Database Router Memcache Last Round Webserver of Funding Feature Roadmap No Eng DBA’s car Training
- 153. Systemic Dashboard Design Database Router Memcache Last Round Webserver of Funding Feature Email is Roadmap down No Eng DBA’s car Training
- 154. Systemic Dashboard Design Database Router Memcache Last Round Webserver of Funding Feature Email is Roadmap down Entire Ops Team No Eng Is At DBA’s car Training Velocity
- 155. Systemic Dashboard Design Database Router Memcache Last Round Webserver of Funding Feature Email is Roadmap down Entire Ops Team No Eng Techcrunch Is At DBA’s car Training Article Velocity
- 156. Systemic Hiring Dashboard Design Difficulties Database Router Memcache Last Round Webserver of Funding Feature Email is Roadmap down Entire Ops Team No Eng Techcrunch Is At DBA’s car Training Article Velocity
- 157. Systemic Hiring S3 is slow Dashboard Design Difficulties Database Router Memcache Last Round Webserver of Funding Feature Email is Roadmap down Entire Ops Team No Eng Techcrunch Is At DBA’s car Training Article Velocity
- 158. Systemic Hiring S3 is slow Dashboard Design Difficulties Database Router Memcache Last Round Webserver of Funding Feature Email is Roadmap down Entire Ops Team No Eng Techcrunch Is At DBA’s car Training Article Velocity
- 159. Systemic
- 160. Systemic
- 161. Systemic
- 162. Systemic
- 163. Systemic
- 164. Systemic
- 165. Systemic
- 166. Functional Resonance In isolation, components act within bounds. Interconnected, they produce emerging behaviors.
- 167. Causes Are Constructed, Not Found WYLFIWYF Pre-conceived notions on “causes” and behaviors
- 169. There is no root cause.
- 170. LEARNING
- 171. Quantifying Response Time to detect? Time for escalation, internal notification? Time to notify the public? Time to graceful degradation? (feature off) Time to stable/resolve? Time to all clear?
- 172. Qualifying Response High signal:noise in comm channels? Troubleshooting fatigue? Troubleshooting handoff? All tools on-hand? Metrics visibility? Collaborative and skillful communication? Improvised tooling or solutions?
- 173. All Together Now • Start/TTD/TTR/Stable/etc. • Severity • DATA (graphs, IRC, etc.) • Description (timeline, etc.) • Observations (motivations, latent conditions, etc.) • Actions (remediation tickets, followup)
- 174. (Anticipation) (Response) Knowing Knowing Knowing Knowing What What What What To Expect To Look For To Do Has Happened (Monitoring) (Learning)
- 175. (Anticipation) (Response) Knowing Knowing Knowing Knowing What What What What To Expect To Look For To Do Has Happened (Monitoring) (Learning)
- 176. Human Error “...knowledge and error flow from the same mental sources, only success can tell one from the other.” Ernest Mach, 1905
- 177. Human Error Nobody comes to work to do a bad job.
- 178. Human Error Useless as a label and ending point.
- 179. Human Error Human error isn’t a cause, it’s an effect.
- 180. Why did it make sense to the person at the time?
- 181. Error Categories • Slips • Lapses • Mismatches • Violations
- 182. Error Categories
- 183. First Stories “Human error” seen as root cause. Counterfactuals: saying what they “should” have done. Prevention: be “more careful!”
- 184. Second Stories “Human error” seen as systemic vulnerabilities, deeper inside the organization. Digging into why it made sense for them to do what they did, at the time they did it. Prevention...
- 185. Why did it make sense to the person at the time?
- 186. Why did it make sense to the person at the time?
- 187. Why did it make sense to the person at the time?
- 188. Substitution Test Could peers have made the same error under the same circumstances?
- 189. Near Misses Hey everybody - Don’t be like me. I tried to X, but because it was no good. It almost exploded everyone. So, don’t do: (details about X) Love, Joe
- 190. WHERE to learn from ?
- 191. Two Propositions
- 192. 100 deploys 6 deploy-related issues
- 193. 100 > 6
- 194. Proposition #1 “Ways in which things go right are special cases of the ways in which things go wrong.”
- 195. Proposition #1 Successes = failures gone wrong Study the failures, generalize from that. 6 100 data sources: out of
- 196. Proposition #2 “Ways in which things go wrong are special cases of the ways in which things go right.”
- 197. Proposition #2 Failures = successes gone wrong Study the successes, generalize from that data sources: 94 out of 100
- 198. 94/100 ? OR 6/100 ?
- 199. What and WHY Do Things Go RIGHT?
- 200. Not just: why did we fail? But also: why did we succeed?
- 201. Taking the New View Recognize that human error is an attribution.
- 202. Taking the New View Pursue Second Stories.
- 203. Taking the New View Escape Hindsight Bias.
- 204. Taking the New View Understand work as performed at the sharp end.
- 205. Taking the New View Examine how changes (at all layers) will produce new vulnerabilities.
- 206. Taking the New View Use technology to support and enhance human expertise.
- 207. Taking the New View Tame complexity through new forms of feedback.
- 208. Taking the New View Realize that your systems are not inherently safe.
- 209. Taking the New View Human error is an inevitable by-product of strained complex systems.
- 210. Taking the New View Human error isn’t at the root of your safety problems.
- 211. Taking the New View Human error isn’t random.
- 212. (Anticipation) (Response) Knowing Knowing Knowing Knowing What What What What To Expect To Look For To Do Has Happened (Monitoring) (Learning)
- 214. Just Culture
- 215. Just Culture Balancing accountability with learning.
- 216. Intentional Malice
- 217. Negligence Found Severity of the Outage
- 218. Name Blame Shame
- 219. Name Blame Shame
- 220. Name WHY? Blame #!@%$&# Shame
- 221. “Must set an example!”
- 222. “Has to be some fear that not doing one’s job correctly could lead to punishment.”
- 223. “Must set an example!” Punishing Deterrents is a not “Has to be some fear that Losing could doing one’s job correctly Proposition lead to punishment.”
- 224. Holding People Accountable != Blaming People
- 225. Accountability and Learning Punishment For Errors
- 226. No Bad Apples Only Bad Theories of Error
- 227. Name WHY? Blame #!@%$&# Shame
- 228. Signs Of Old View “Gross Misconduct” “Carelessness” “Negligence” “Egregious Behavior” “Willful Violations”
- 229. Discretionary Spaces
- 234. Acceptable (who draws this subjective line?) Unacceptable
- 235. Increase Accountability By Supporting Learning
- 236. Empower People Let them own their own stories. Don’t make people pay penalties. Allow them to educate the organization.
- 237. Reduce Uncertainty Make it clear who defines acceptable behavior.
- 238. Organizational Roots Accountability = Responsibility + Requisite Authority
- 239. (Anticipation) (Response) Knowing Knowing Knowing Knowing What What What What To Expect To Look For To Do Has Happened (Monitoring) (Learning)
- 241. (Thanks, Fellas) Dr. Erik Hollnagel Dr. David Woods Dr. Sidney Dekker Dr. Richard Cook
- 242. Homework!
- 243. THE END
- 244. • Photo Credits http://www.flickr.com/photos/51035644987@N01/2678090600/ • http://www.flickr.com/photos/67196253@N00/2941655917/ • http://www.flickr.com/photos/stirwise/417629641 • http://www.flickr.com/photos/38383999@N06/3888057995/ • http://www.flickr.com/photos/94443490@N00/361543080/ • http://www.flickr.com/photos/7729940@N06/4333396494/ • http://www.flickr.com/photos/cpstorm/167418602 • http://www.flickr.com/photos/63474264@N00/4366221069/ • http://www.flickr.com/photos/proimos/4199675334 • http://www.flickr.com/photos/30475691@N07/2862060992/ • http://www.flickr.com/photos/14663487@N00/797755046/ • http://www.flickr.com/photos/25080113@N06/5361445631/