197 lines
42 KiB
HTML
197 lines
42 KiB
HTML
<!DOCTYPE html><script type="module">document.addEventListener("DOMContentLoaded",()=>{const o=document.querySelectorAll(".prose-styles h1,.prose-styles h2, .prose-styles h3"),s=document.getElementById("table-of-contents");if(s&&o.length>0){const n=document.createElement("ul");n.classList.add("divide-y-2","divide-black","border-black"),o.forEach(e=>{const l=parseInt(e.tagName.slice(1)),d=document.createElement("li");d.classList.add("p-4");const t=document.createElement("a");t.textContent=l==1?e.textContent:"– ".repeat(l-1)+e.textContent,t.href=`#${e.id}`,t.classList.add("prose-styles"),d.appendChild(t),n.appendChild(d)}),s.appendChild(n),s.classList.remove("hidden")}});</script> <html lang="en" class="scroll-smooth selection:bg-black selection:text-lila-500 no-touchevents hydrated"> <head><title>The Theory Behind Understanding Failure</title>
|
||
<meta name="description" content="I am Evan and I'm a Site Reliability Engineer. This blog is a collection of technical topics and things I've learned.">
|
||
<link rel="canonical" href="https://iamevan.me">
|
||
<meta property="og:title" content="The Theory Behind Understanding Failure">
|
||
<meta property="og:description" content="In the last 100 years, there’s been a lot of intense and distributed advancement in technology, and our use of it as a species. As technology advanced, it also brought catastrophic and costly failure. There’s a lot to be learned about the theory behind failure, safety and resiliency, on the back of the events of the 20th century.">
|
||
<meta property="og:url" content="https://iamevan.me">
|
||
<meta property="og:type" content="blog">
|
||
<meta property="og:image" content="https://iamevan.me/images/posts/the-theory-behind-understanding-failure/image.png">
|
||
|
||
<meta property="og:locale" content="en_GB">
|
||
<meta property="og:site_name" content="Evan Smith"> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <!-- Favicons --> <link rel="icon" href="/favicons/favicon.ico" sizes="any"> <link rel="apple-touch-icon" href="/favicons/apple-touch-icon.png"> <link rel="manifest" href="/favicons/manifest.webmanifest"> <!-- Favicon for IE --> <link rel="shortcut icon" href="/favicons/favicon.ico" type="image/x-icon"> <!-- Favicons for different sizes --> <link rel="icon" type="image/png" sizes="16x16" href="/favicons/favicon-16x16.png"> <link rel="icon" type="image/png" sizes="32x32" href="/favicons/favicon-32x32.png"> <link rel="icon" type="image/png" sizes="48x48" href="/favicons/favicon-48x48.png"> <!-- Additional SEO --> <meta name="robots" content="index, follow"> <meta name="googlebot" content="index, follow"> <!-- Apple Touch Icon (already included in favicons, but keeping for backwards compatibility) --> <link rel="apple-touch-icon" sizes="180x180" href="/favicons/apple-touch-icon.png"> <!-- For IE --> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <!--- Bricolage Grotesque font from Google Fonts --> <link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link href="https://fonts.googleapis.com/css2?family=Bricolage+Grotesque:opsz,wght@12..96,200;12..96,300;12..96,400;12..96,500;12..96,600;12..96,700;12..96,800&display=swap" rel="stylesheet"> <!----------------------------------------
|
||
//Integrations
|
||
//
|
||
------------------------------------------> <!----
|
||
Tipyjs integrations: https://atomiks.github.io/tippyjs/
|
||
--> <link rel="stylesheet" href="https://unpkg.com/tippy.js@6/dist/tippy.css"> <link rel="stylesheet" href="https://unpkg.com/tippy.js/themes/light.css"> <script src="https://cdn.jsdelivr.net/npm/@ryangjchandler/alpine-tooltip@1.x.x/dist/cdn.min.js" defer></script> <!---- Alpine integrations --> <script defer src="https://unpkg.com/@alpinejs/focus@3.10.3/dist/cdn.min.js"></script> <script defer src="https://cdn.jsdelivr.net/npm/@alpinejs/intersect@3.10.3/dist/cdn.min.js"></script> <script defer src="https://unpkg.com/alpinejs@3.10.5/dist/cdn.min.js"></script><link rel="stylesheet" href="/_astro/_slug_.DEYeOnzk.css"></head> <body class="border-x-2 border-black bg-white flex flex-col min-h-screen"> <div class="mx-auto w-full bg-lila-500 2xl:border-2 justify-center sticky top-0 z-20 2xl:max-w-7xl border-y-2 border-black"> <div class="mx-auto w-full flex flex-col lg:flex-row py-6 md:py-0 lg:items-center lg:justify-between 2xl:max-w-7xl px-8 md:px-0" x-data="{ open: false }"> <div class="text-black items-center flex justify-between flex-row"> <a class="items-center font-bold gap-3 inline-flex text-lg tracking-tighter md:hidden" title="Home" aria-label="Home" href="/">Home
|
||
</a> <button class="focus:outline-none focus:shadow-outline md:hidden ml-auto border-2 border-black bg-red-500" @click="open = !open"><svg class="h-8 w-8" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path :class="{'hidden': open, 'inline-flex': !open }" class="inline-flex" d="M4 6h16M4 12h16M4 18h16" stroke-linecap="round" stroke-linejoin="round" stroke-width="2"></path><path :class="{'hidden': !open, 'inline-flex': open }" class="hidden" d="M6 18L18 6M6 6l12 12" stroke-linecap="round" stroke-linejoin="round" stroke-width="2"></path> </svg> </button> </div> <nav :class="{'flex': open, 'hidden': !open}" class="flex-col items-center flex-grow hidden md:flex text-black text-lg font-medium tracking-wide md:flex-row md:justify-start md:mt-0 gap-4 lg:p-0 py-2 md:py-0 md:px-0 md:pb-0 px-5"> <a class="duration-300 focus:text-orange/90 hover:text-lila-900 px-4 py-2 transform transition md:ml-8 lg:ml-16 2xl:ml-0" title="Home" aria-label="Home" href="/">
|
||
Home
|
||
</a> <a class="duration-300 focus:text-orange/90 hover:text-lila-900 px-4 py-2 transform transition" title="Blog" aria-label="Blog" href="/blog">
|
||
Blog
|
||
</a> <a class="duration-300 focus:text-orange/90 hover:text-lila-900 px-4 py-2 transform transition" title="About" aria-label="About" href="/info/about">
|
||
About
|
||
</a> <a class="duration-300 focus:text-orange/90 hover:text-lila-900 px-4 py-2 transform transition" title="RSS" aria-label="RSS" href="/rss.xml">
|
||
RSS
|
||
</a> <a class="text-white md:ml-auto bg-black border-l-2 border-black duration-500 ease-in-out focus:outline-none ring-inset ring-offset-black focus:ring-2 focus:ring-black focus:ring-offset-2 h-12 lg:h-20 hover:bg-white hover:text-black inline-flex tracking-wide items-center justify-center px-6 text-center transform transition py-2 md:py-4 gap-1" title="Kind Engineering: How To Engineer Kindly" aria-label="Kind Engineering: How To Engineer Kindly" href="https://kind.engineering"> <span>Kind Engineering</span> <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="icon icon-tabler icons-tabler-outline icon-tabler-external-link"><path stroke="none" d="M0 0h24v24H0z" fill="none"></path><path d="M12 6h-6a2 2 0 0 0 -2 2v10a2 2 0 0 0 2 2h10a2 2 0 0 0 2 -2v-6"></path><path d="M11 13l9 -9"></path><path d="M15 4h5v5"></path></svg> </a> </nav> </div> <section class="2xl:max-w-7xl mx-auto"> <div class="mx-auto bg-lila-500 2xl:border-x-2 border-t-2 border-black"> <div class="text-center p-8 lg:p-20 2xl:px-4 lg:py-2 bg-black"> <p class="text-white lg:leading-tight font-thin">
|
||
Want to work with me?
|
||
<a href="https://grnh.se/d2v99ov08us" class="underline">SWE Manager (Remote, Ireland)</a>
|
||
| <a href="https://grnh.se/9b4egbnc8us" class="underline">Senior SWE (Remote, Ireland)</a> </p> </div> </div> </section> </div> <main class="flex-grow"> <section aria-labelledby="post" id="post" class="mx-auto 2xl:max-w-7xl bg-violet-300 border-b-2 2xl:border-x-2 border-black"> <img class="h-96 w-full object-cover" src="/images/posts/the-theory-behind-understanding-failure/image.png" alt="#"> </section> <section> <div class="2xl:max-w-7xl mx-auto 2xl:border-x-2 border-black"> <p class="text-5xl font-display text-balance font-black md:text-7xl lg:text-8xl uppercase text-white"> </p> </div> <div class="2xl:border-x-2 border-black 2xl:max-w-7xl mx-auto"> <div class="grid grid-cols-1 lg:grid-cols-4 lg:divide-x-2 lg:divide-black"> <div class="lg:col-span-1"> <div id="table-of-contents" class="hidden lg:block border-b border-black top-20"> <div class="p-4 border-b-2 border-black"> <h3 class="text-black text-3xl uppercase font-display">
|
||
Table of contents
|
||
</h3> </div> <!--
|
||
//Your table of contents content here
|
||
--> </div> </div> <div class="lg:col-span-3 p-8 lg:p-20"> <div class="prose-styles"> <blockquote>
|
||
<p>Every system always operates at its capacity. As soon as there is some improvement, some new technology, we stretch it.</p>
|
||
<p>— Larry Hirschorn, “A Tale of Two Stories: Contrasting Views of Patient Safety” by Woods & Cook, 1997</p>
|
||
</blockquote>
|
||
<h2 id="why-do-complex-systems-fail">Why do complex systems fail?</h2>
|
||
<p>In the last 100 years, there’s been a lot of intense and distributed advancement in technology, and our use of it as a species. As technology advanced, it also brought catastrophic and costly failure. There’s a lot to be learned about the theory behind failure, safety and resiliency, on the back of the events of the 20th century.</p>
|
||
<p>To understand why failure happens, a popular and still-relevant model is the “Rasmussen Migration Model” (1997) which tries to describe the forces/pressures acting on a system, and influences the system to “drift into danger”. It’s well regarded within the Resilience Engineering and Safety Culture areas of research.</p>
|
||
<p>Smarter people than me explain this much better, but I’m going to try and do my best to talk about it in my own words for the sake of a complete story in this post.</p>
|
||
<p>Other, fabulous explanations are:</p>
|
||
<ul>
|
||
<li>
|
||
<p><a href="https://youtu.be/PGLYEDpNu60?si=19MlY-xaQBts97VH">https://youtu.be/PGLYEDpNu60?si=19MlY-xaQBts97VH</a> (20 min watch)</p>
|
||
</li>
|
||
<li>
|
||
<p><a href="https://risk-engineering.org/concept/Rasmussen-practical-drift">https://risk-engineering.org/concept/Rasmussen-practical-drift</a> (30 min read)</p>
|
||
</li>
|
||
</ul>
|
||
<h3 id="what-is-a-system-and-what-are-our-constraints">What is a System? And what are our constraints?</h3>
|
||
<p>We can think of our System’s current state as an “operating point” that moves randomly and erratically inside the full space of possibility allowed to it. Importantly, our System is not just our software, infrastructure or technological systems, it also includes the people who build, maintain and operate those systems. The complex system we run is more than just the code we write, it is the people we are. For the sake of this whole post, the limit of our System is Product Engineering.</p>
|
||
<p>If we took all humans and non-software factors out of the equation, you <em>could</em> think of the Operating Point as our software working efficiently, correctly and profitably. It’s not throwing exceptions. It’s not crashing out. And it’s not overwhelmed. The Operating Point is “within parameters”.</p>
|
||
<p>But our systems don’t exist in a vacuum, and we have boundaries and constraints that we want to avoid as best we can:</p>
|
||
<ul>
|
||
<li>
|
||
<p><strong>Economic failure</strong>: Our system is not profitable enough, or is too costly and inefficient to be funded to run.</p>
|
||
</li>
|
||
<li>
|
||
<p><strong>Unacceptable workload:</strong> The burden on our people and technology is too large to continue.</p>
|
||
</li>
|
||
<li>
|
||
<p><strong>Acceptable performance:</strong> We take too many risks, and accidents occur.</p>
|
||
</li>
|
||
</ul>
|
||
<div style="width: 40%; float: left;">
|
||
<p><img src="/images/posts/the-theory-behind-understanding-failure/image1.png" alt=""></p>
|
||
</div>
|
||
<div style="width: 55%; float: left; margin-left: 3%; display: block;">
|
||
<p><img src="/images/posts/the-theory-behind-understanding-failure/image2.png" alt=""></p>
|
||
</div>
|
||
<h3 id="easy-fix-just-stay-in-the-middle">Easy fix: Just stay in the middle.</h3>
|
||
<p>There are two reasons why we can’t look at this model, digest it and decide point-blank to stay in the middle:</p>
|
||
<ol>
|
||
<li>
|
||
<p>You’ll have noticed how <em>heavily</em> theoretical this model is. It’s hard to define these boundaries in concrete, measurable terms. And even harder to quantify the current state of the Operating Point because it “<strong>moves randomly and erratically”</strong> (like brownian motion) even when no force is acting on it.</p>
|
||
</li>
|
||
<li>
|
||
<p>There is <strong>always some kind of force acting on it</strong>. Our System is influenced by people, society and <em>other</em> complex systems. We cannot escape external influence.</p>
|
||
</li>
|
||
</ol>
|
||
<p>Below I’ve stolen an example of two forces on our Operating Point from one of the sources I mentioned above:</p>
|
||
<p><img src="/images/posts/the-theory-behind-understanding-failure/image3.png" alt=""></p>
|
||
<p>The competitive environment encourages decision-makers to focus on short-term <strong>financial success</strong> and survival, rather than on long-term criteria (including safety).</p>
|
||
<p><img src="/images/posts/the-theory-behind-understanding-failure/image4.png" alt=""></p>
|
||
<p>Workers will seek to maximise the efficiency of their work, with a gradient in the direction of <strong>reduced workload</strong> (in particular if they are encouraged by a “cheaper, faster, better” organisational goal).</p>
|
||
<p><img src="/images/posts/the-theory-behind-understanding-failure/image5.png" alt=""></p>
|
||
<p>These pressures push work to migrate towards the limits of acceptable (safe) performance. Accidents occur when the system’s activity crosses the boundary into unacceptable safety.</p>
|
||
<p>The example uses two competing forces: pressure for financial success and the pressure to reduce employee workload. It is important to highlight that this model does not include any moral judgements. This drift towards failure is not caused by any particular group’s intent to create an incident, or cause an accident. <strong>It is a byproduct of our innate human nature to adapt to our environment, its constraints, and our instructions.</strong></p>
|
||
<h3 id="what-does-this-look-like-in-reality">What does this look like in reality?</h3>
|
||
<p>I like the idea of the Gamma Knife Model as an analogy for how this all works in practice. So I’m going to rob it wholesale from the person who wrote it: <a href="https://surfingcomplexity.blog/2019/08/25/the-gamma-knife-model-of-incidents/">Lorin Hochstein <strong>The Gamma Knife model of incidents</strong></a></p>
|
||
<blockquote>
|
||
<p>Gamma knife (<a href="https://en.wikipedia.org/wiki/Radiosurgery#Gamma_Knife">https://en.wikipedia.org/wiki/Radiosurgery#Gamma_Knife</a>) is a system that surgeons use for treating brain tumors by focusing multiple beams of gamma radiation on a small volume inside of the brain.</p>
|
||
<p>Each individual beam is of low enough intensity that it doesn’t affect brain tissue. It is only when multiple beams intersect at one point that the combined intensity of the radiation has an impact.</p>
|
||
<p>Every day inside of your system, there are things that are happening (or not happening(!)) that could potentially enable an incident. You can think of each of these as a low-level beam of gamma radiation going off in a random direction. Somebody pushes a change to production, zap! Somebody makes a configuration change with a typo, zap! Somebody goes on vacation, zap! There’s an on-call shift change, zap! A particular service hasn’t been deployed in weeks, zap!</p>
|
||
<p>Most of these zaps are harmless, they have no observable impact on the health of the overall system. Sometimes, though, many of these zaps will happen to go off at the same time and all point to the same location. When that happens, boom, you have an incident on your hands.</p>
|
||
</blockquote>
|
||
<h2 id="why-dont-complex-systems-fail">Why DON’T complex systems fail?</h2>
|
||
<blockquote>
|
||
<p>What is surprising in this world is not that there are so many accidents, it is that there are so few. [Software engineers] know this to be true. The thing that amazes you is not that your system goes down sometimes, but that it is up at all.</p>
|
||
<p>— Richard Cook, “Resilience In Complex Adaptive Systems”</p>
|
||
</blockquote>
|
||
<p>An undeniable fact is that not every complex system over the last century has gone up in flames and reset our progress in society to zero, so what can we do to make our systems more resilient to failure when it happens?</p>
|
||
<p>The main four categories, at least according to folks like Richard Cook and John Allspaw, are:</p>
|
||
<ul>
|
||
<li>
|
||
<p><strong>Monitoring:</strong> For software, we immediately think of observability for our running technology, but this also includes employee surveys, tracking workloads and caring for people, technology and the company altogether.</p>
|
||
</li>
|
||
<li>
|
||
<p><strong>Reacting:</strong> Incident response, mitigating issues, applying bug fixes, scheduling PTO, transparency around planning/decisions, direct communication, etc.</p>
|
||
</li>
|
||
<li>
|
||
<p><strong>Anticipating:</strong> Preventative care, which can look a lot like the above list. Other examples are design documents, long-term vision/design planning, documenting priorities and tradeoffs, timeline warnings about changes and workload increases.</p>
|
||
</li>
|
||
<li>
|
||
<p><strong>Learning:</strong> When something does go wrong, how do we understand and analyse it?</p>
|
||
</li>
|
||
</ul>
|
||
<p><strong>Learning</strong> is the one I want to focus on for the rest of this post.</p>
|
||
<h2 id="learning-understanding-failure">Learning: Understanding failure</h2>
|
||
<h3 id="there-is-no-root-cause">There is no root cause</h3>
|
||
<p>I’m hoping that from the above, there is already a thought percolating in your noggin, but to be explicit about it: <strong>Every incident is a collection of cascading failures, there is no Root Cause.</strong></p>
|
||
<p><img src="/images/posts/the-theory-behind-understanding-failure/image7.png" alt=""></p>
|
||
<p>As an engineer, you might immediately balk at that statement. Our job is to boil down complex problems into simple, solvable chunks. We <em>want</em> there to be a root cause, because if we can fix that bug, we can solve the incident and prevent that issue from happening again… right?</p>
|
||
<p>We saw in the Rasmussen Model that the drift towards danger, and incidents, is caused by the natural adaptive forces of The Universe™️. We should instead view the causes as <a href="https://www.notion.so/The-Theory-Behind-Understanding-Failure-17de644a24fa807bb76cc02897577da4?pvs=21">a game of Buckaroo</a>, and the latest, most apparent cause, as the straw that finally broke the camel’s back.</p>
|
||
<p>From <a href="https://www.kitchensoap.com/2012/02/10/each-necessary-but-only-jointly-sufficient/">John Allspaw <strong>Kitchen Soap – Each necessary, but only jointly sufficient</strong></a>:</p>
|
||
<blockquote>
|
||
<p>Regardless of the implementation, most systemic models recognize these things:</p>
|
||
<p>• …that complex systems involve not only technology but organizational (social, cultural) influences, and those deserve equal (if not more) attention in investigation</p>
|
||
<p>• …that fundamentally surprising results come from behaviors that are emergent. This means they can and do come from components interacting in ways that cannot be predicted.</p>
|
||
<p>• …that nonlinear behaviors should be expected. A small perturbation can result in catastrophically large and cascading failures.</p>
|
||
<p>• …human performance and variability are not intrinsically coupled with causes. Terms like “situational awareness” and “crew resource management” are blunt concepts that can mask the reasons why it made sense for someone to act in a way that they did with regards to a contributing cause of a failure.</p>
|
||
<p>• …diversity of components and complexity in a system can augment the resilience of a system, not simply bring about vulnerabilities.</p>
|
||
</blockquote>
|
||
<p>In reducing the factors of an incident down to singular root cause, we are doing a disservice to our own ability to prevent more failure in the future, and we are polluting our learning with Hindsight Bias that leaves us with a document preserving only one chain of “<em>Why</em>”s in a sea of other questions.</p>
|
||
<p>Having a root cause also reduces the incident’s accountability down to the person who made that error, which moves us from attributing a single factor to a person to blaming that person for what happened overall.</p>
|
||
<h3 id="blame-vs-attribution">Blame vs Attribution</h3>
|
||
<p>I think, and correct me if I’m wrong, people intuitively understand why the reflection on failure should be <em>blameless</em>. Our empathy for each other means we don’t want people to shoulder the unearned burden of feeling like they single-handedly caused an outage or a problem and dragged us from our slumber at 4AM for a 16-hour-long day. Partly, because it’s never singly their fault.</p>
|
||
<p>That being said, being blameless does not mean that we cannot know who performed an action, who made an error, who did something they shouldn’t have at an inopportune time. It is important we have the ability to interview that person and get to ask questions about their goals, assumptions, motivations and thought process throughout.</p>
|
||
<p>We achieve these by both reinforcing the idea that that an incident is caused by many different failures, and that no action taken innocently without malice should result in punishment. Yes, you hit the big red button that took down prod, but we want to know why you did it, what assumptions you made and what your goal was with pushing it. And the important bit is that we knew and acknowledge <em>you</em> did it. Otherwise, how would we get to learn from any of this. We’d just be ignoring the elephant in the room.</p>
|
||
<p>Everyone should feel psychologically, and financially, safe to put their hand up and admit that they made a mistake. And the response should be an enthusiastic thank you.</p>
|
||
<p>Excerpt from <a href="https://itrevolution.com/articles/kata/">IT Revolution <strong>The Andon Cord</strong></a>:</p>
|
||
<blockquote>
|
||
<p>A second important cultural aspect of the “Andon Cord” process at Toyota was that when the team leader arrived at the workstation, he or she thanked the team member who pulled the Cord. This was another unconditional behavior reinforcement. The repetition of this simple gesture formed a learning pattern of what we call today “Safety Culture”. The team member did not, or would never be, in a position of feeling fear or retribution for stopping the line.</p>
|
||
<p>Quite the contrary, the team member was always rewarded verbally. What Toyota was saying to the team member was “We thank you and your CEO thanks you. You have saved a customer from receiving a defect.” Moreover, they were saying, “You have given us (Toyota) an opportunity to learn and for that we really thank you.</p>
|
||
</blockquote>
|
||
<h3 id="anticipating-failure-is-hard">Anticipating failure is hard</h3>
|
||
<p>We do not have a company-expensed crystal scrying orb mounted to the walls of our Cork office, and we cannot pore over it every Monday at our team meeting to see what the week will hold. As much as we try, we cannot predict the future. And this holds true for the tests we write, the verification steps we take, or the risk assessments we write.</p>
|
||
<p>If you can foresee a problem that is easy to address now, you should absolutely do it. This is not some Nietzsche-esque call to “nothing matters, so why bother”. Instead, I want us to collectively acknowledge that no matter how much we plan and prepare for failure, we will never exist in a reality where it does not happen. I would go even further and say that not only <em>will</em> failure happen, it will happen <em>often</em>.</p>
|
||
<p>We are building software under the pressure of economics, and that requires us to push the boundaries and capacity of technology to run leaner, run faster, and run at scale. Even if the pressures aren’t explicit, they are implicit in running a successful business that keeps us all employed.</p>
|
||
<p>Instead, we should always strive to be explicit and communicative when we’re taking risk, and we should be at peace that failure will happen.</p>
|
||
<h3 id="failure-is-good-actually">Failure is good, actually</h3>
|
||
<p>Every incident we retro, every bug we fix, every document we write, is another brick in the foundation of our resilience. As we encounter and respond to failure, we add a force to the Rasmussen model that pushes our Operating Point us further away from the unsafe boundary and gives us more room to innovate, take risks, and improve upon what we have.</p>
|
||
<p>There are practical mechanisms for managing and quantifying the amount of failure we’re comfortable with as a company, but this isn’t the place to list them. What’s important is that we embrace failure as the best learning opportunity we’ll get.</p>
|
||
<p>Excerpt from <a href="https://itrevolution.com/articles/kata/">IT Revolution <strong>The Andon Cord</strong></a></p>
|
||
<blockquote>
|
||
<p>There is a great story in the Toyota Kata book where at one point a particular Toyota plant notices that the average Andon Cord pulls in a shift goes down from 1000 to 700. As Rother describes most western culture organizations would break out the champagne for such an occasion, not Toyota. The CEO called an all-hands meeting to address the “problem”.</p>
|
||
<p>Notice I said problem.</p>
|
||
<p>The CEO then goes on to describe that “we” must have one of two problems here. One, we are getting lazy and letting more defects get through the system or two, if that is not the case, then we are not operating at our full potential. He was telling everyone that if they were staffed to handle 1000 pulls per shift, then they should be pulling a 1000 Cords per shift.</p>
|
||
<p>In plain words, the CEO is saying more pulls equals more learning which means more improvement that gets us towards our vision. 1X1 was a means to an end to say “If we can produce cars faster, cheaper and with higher quality, we win.</p>
|
||
</blockquote>
|
||
<h2 id="in-conclusion">In Conclusion</h2>
|
||
<p>Incidents are caused by a collection of, often emergent and unpredictable, behaviours in both our systems and our people that we should not aim to condense or shy away from. Doing so:</p>
|
||
<ul>
|
||
<li>
|
||
<p>Convinces us our systems are safer than they are.</p>
|
||
</li>
|
||
<li>
|
||
<p>Leads to a poorer understanding of our systems.</p>
|
||
</li>
|
||
<li>
|
||
<p>Concentrates blame.</p>
|
||
</li>
|
||
<li>
|
||
<p>Revises history after the fact with Hindsight Bias.</p>
|
||
</li>
|
||
<li>
|
||
<p>Robs us of the chance to push ourselves further from the unsafe boundary.</p>
|
||
</li>
|
||
</ul>
|
||
<hr>
|
||
<h2 id="further-reading">Further reading</h2>
|
||
<p>I’ve mentioned most of these, but Resilience Engineering is a massive academic area of study, so I figured I could curate some things that are probably the most relevant to us.</p>
|
||
<h3 id="building-resilient-softwareculture">Building resilient software/culture</h3>
|
||
<p><a href="https://prod-files-secure.s3.us-west-2.amazonaws.com/bf750b11-1b41-450b-baca-4a40fc9714f0/da20790d-845c-4904-8016-b32fb6092e84/The_theory_of_graceful_extensibility_-_basic_rules_that_govern_adaptive_systems.pdf">The theory of graceful extensibility - basic rules that govern adaptive systems.pdf</a></p>
|
||
<p><a href="https://ferd.ca/complexity-has-to-live-somewhere.html">https://ferd.ca/complexity-has-to-live-somewhere.html</a></p>
|
||
<p><a href="https://itrevolution.com/kata/">https://itrevolution.com/kata/</a></p>
|
||
<h3 id="understanding-failure-and-safety">Understanding failure and safety</h3>
|
||
<p><a href="https://how.complexsystems.fail/">https://how.complexsystems.fail/</a></p>
|
||
<p><a href="https://risk-engineering.org/concept/Rasmussen-practical-drift">https://risk-engineering.org/concept/Rasmussen-practical-drift</a></p>
|
||
<p><a href="https://surfingcomplexity.blog/2019/08/25/the-gamma-knife-model-of-incidents/">https://surfingcomplexity.blog/2019/08/25/the-gamma-knife-model-of-incidents/</a></p>
|
||
<p><a href="https://www.kitchensoap.com/2014/11/14/the-infinite-hows-or-the-dangers-of-the-five-whys/">https://www.kitchensoap.com/2014/11/14/the-infinite-hows-or-the-dangers-of-the-five-whys/</a></p>
|
||
<p><a href="https://www.kitchensoap.com/2012/02/10/each-necessary-but-only-jointly-sufficient/">https://www.kitchensoap.com/2012/02/10/each-necessary-but-only-jointly-sufficient/</a></p>
|
||
<p><a href="https://github.com/lorin/resilience-engineering/blob/master/intro.md#changing-perspectives-on-accidents-and-safety">https://github.com/lorin/resilience-engineering/blob/master/intro.md#changing-perspectives-on-accidents-and-safety</a></p> </div> </div> </div> </div> </section> </main> <footer class="overflow-hidden"> <div class="p-8 lg:p-20 pb-0 lg:pb-0 2xl:max-w-7xl mx-auto bg-black border-b border-black"> <div class="h-full space-y-12 lg:space-y-0 pb-12 lg:pb-48"> <div class="grid grid-cols-1 lg:grid-cols-3 gap-12 lg:gap-32 items-start"> <div class="flex flex-col gap-6 lg:col-span-2 max-w-xl"> <div> <!-- <h3
|
||
class="text-3xl md:text-4xl text-white lg:text-5xl font-medium tracking-tight">
|
||
Subscribe, get tips to grow the way you deserve.
|
||
</h3> --> </div> <div class="flex flex-col gap-6" x-data="{ year: new Date().getFullYear() }"> <p class="text-white text-xl font-normal tracking-wide">
|
||
Evan Smith <span>© Copyright <span x-text="year"></span>.</span> </p> <div class="flex gap-4"> <a title="Mastodon: thejokersthief@mastodon.ie" aria-label="Mastodon: thejokersthief@mastodon.ie" href="https://mastodon.ie/@thejokersthief" class="flex h-10 w-10 items-center justify-center hover:shadow-none hover:border-white border-2 border-black shadow-tiny duration-300 shadow-white hover:translate-x-1 hover:translate-y-1 rounded-full bg-white focus:bg-black focus:text-white"> <div> <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="icon icon-tabler icons-tabler-outline icon-tabler-brand-mastodon size-4"><path stroke="none" d="M0 0h24v24H0z" fill="none"></path><path d="M18.648 15.254c-1.816 1.763 -6.648 1.626 -6.648 1.626a18.262 18.262 0 0 1 -3.288 -.256c1.127 1.985 4.12 2.81 8.982 2.475c-1.945 2.013 -13.598 5.257 -13.668 -7.636l-.026 -1.154c0 -3.036 .023 -4.115 1.352 -5.633c1.671 -1.91 6.648 -1.666 6.648 -1.666s4.977 -.243 6.648 1.667c1.329 1.518 1.352 2.597 1.352 5.633s-.456 4.074 -1.352 4.944z"></path><path d="M12 11.204v-2.926c0 -1.258 -.895 -2.278 -2 -2.278s-2 1.02 -2 2.278v4.722m4 -4.722c0 -1.258 .895 -2.278 2 -2.278s2 1.02 2 2.278v4.722"></path></svg> </div> </a> <a title="Github: TheJokersThief" aria-label="Github: TheJokersThief" href="https://github.com/TheJokersThief" class="flex h-10 w-10 items-center justify-center hover:shadow-none hover:border-white border-2 border-black shadow-tiny duration-300 shadow-white hover:translate-x-1 hover:translate-y-1 rounded-full bg-white focus:bg-black focus:text-white"> <div> <svg xmlns="http://www.w3.org/2000/svg" class="icon icon-tabler icon-tabler-brand-github-filled size-4" width="20" height="20" viewBox="0 0 24 24" stroke-width="2" stroke="currentColor" fill="none" stroke-linecap="round" stroke-linejoin="round"> <path stroke="none" d="M0 0h24v24H0z" fill="none"></path> <path d="M5.315 2.1c.791 -.113 1.9 .145 3.333 .966l.272 .161l.16 .1l.397 -.083a13.3 13.3 0 0 1 4.59 -.08l.456 .08l.396 .083l.161 -.1c1.385 -.84 2.487 -1.17 3.322 -1.148l.164 .008l.147 .017l.076 .014l.05 .011l.144 .047a1 1 0 0 1 .53 .514a5.2 5.2 0 0 1 .397 2.91l-.047 .267l-.046 .196l.123 .163c.574 .795 .93 1.728 1.03 2.707l.023 .295l.007 .272c0 3.855 -1.659 5.883 -4.644 6.68l-.245 .061l-.132 .029l.014 .161l.008 .157l.004 .365l-.002 .213l-.003 3.834a1 1 0 0 1 -.883 .993l-.117 .007h-6a1 1 0 0 1 -.993 -.883l-.007 -.117v-.734c-1.818 .26 -3.03 -.424 -4.11 -1.878l-.535 -.766c-.28 -.396 -.455 -.579 -.589 -.644l-.048 -.019a1 1 0 0 1 .564 -1.918c.642 .188 1.074 .568 1.57 1.239l.538 .769c.76 1.079 1.36 1.459 2.609 1.191l.001 -.678l-.018 -.168a5.03 5.03 0 0 1 -.021 -.824l.017 -.185l.019 -.12l-.108 -.024c-2.976 -.71 -4.703 -2.573 -4.875 -6.139l-.01 -.31l-.004 -.292a5.6 5.6 0 0 1 .908 -3.051l.152 -.222l.122 -.163l-.045 -.196a5.2 5.2 0 0 1 .145 -2.642l.1 -.282l.106 -.253a1 1 0 0 1 .529 -.514l.144 -.047l.154 -.03z" stroke-width="0" fill="currentColor"></path> </svg> </div> </a> <a title="Bluesky: @thejokersthief.bsky.social" aria-label="Bluesky: @thejokersthief.bsky.social" href="https://bsky.app/profile/thejokersthief.bsky.social" class="flex h-10 w-10 items-center justify-center hover:shadow-none hover:border-white border-2 border-black shadow-tiny duration-300 shadow-white hover:translate-x-1 hover:translate-y-1 rounded-full bg-white focus:bg-black focus:text-white"> <div> <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="icon icon-tabler icons-tabler-outline icon-tabler-brand-bluesky size-4"><path stroke="none" d="M0 0h24v24H0z" fill="none"></path><path d="M6.335 5.144c-1.654 -1.199 -4.335 -2.127 -4.335 .826c0 .59 .35 4.953 .556 5.661c.713 2.463 3.13 2.75 5.444 2.369c-4.045 .665 -4.889 3.208 -2.667 5.41c1.03 1.018 1.913 1.59 2.667 1.59c2 0 3.134 -2.769 3.5 -3.5c.333 -.667 .5 -1.167 .5 -1.5c0 .333 .167 .833 .5 1.5c.366 .731 1.5 3.5 3.5 3.5c.754 0 1.637 -.571 2.667 -1.59c2.222 -2.203 1.378 -4.746 -2.667 -5.41c2.314 .38 4.73 .094 5.444 -2.369c.206 -.708 .556 -5.072 .556 -5.661c0 -2.953 -2.68 -2.025 -4.335 -.826c-2.293 1.662 -4.76 5.048 -5.665 6.856c-.905 -1.808 -3.372 -5.194 -5.665 -6.856z"></path></svg> </div> </a> <a title="Linkedin: thejokersthief" aria-label="Linkedin: thejokersthief" href="https://www.linkedin.com/in/thejokersthief/" class="flex h-10 w-10 items-center justify-center hover:shadow-none hover:border-white border-2 border-black shadow-tiny duration-300 shadow-white hover:translate-x-1 hover:translate-y-1 rounded-full bg-white focus:bg-black focus:text-white"> <div> <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="icon icon-tabler icons-tabler-outline icon-tabler-brand-linkedin size-4"><path stroke="none" d="M0 0h24v24H0z" fill="none"></path><path d="M8 11v5"></path><path d="M8 8v.01"></path><path d="M12 16v-5"></path><path d="M16 16v-3a2 2 0 1 0 -4 0"></path><path d="M3 7a4 4 0 0 1 4 -4h10a4 4 0 0 1 4 4v10a4 4 0 0 1 -4 4h-10a4 4 0 0 1 -4 -4z"></path></svg> </div> </a> </div> </div> </div> <nav class="grid grid-cols-1 gap-x-12 gap-y-4 l justify-between text-base tracking-wide items-center text-white" role="navigation"> <a class="hover:text-lila-500" title="Home" aria-label="Home" href="/">Home</a> <a class="hover:text-lila-500" title="Blog" aria-label="Blog" href="/blog">Blog</a> <a class="hover:text-lila-500" title="RSS" aria-label="RSS" href="/rss.xml">RSS</a> </nav> </div> </div> <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" fill="#f5f5f5" class="lg:mt-10 lg:-mx-131 lg:scale-[3] mx-auto" preserveAspectRatio="xMidYMid" viewBox="0 0 890 184" style="max-height: 200px"> <path d="M711.000,6.000 C719.076,6.031 722.275,8.039 727.000,11.000 C727.333,43.330 727.667,75.670 728.000,108.000 C728.667,107.667 729.333,107.333 730.000,107.000 C731.912,88.059 742.645,57.200 753.000,44.000 C759.813,44.203 765.641,45.598 770.000,48.000 C766.302,72.181 759.405,107.138 771.000,127.000 C772.000,127.333 773.000,127.667 774.000,128.000 C776.333,126.667 778.667,125.333 781.000,124.000 C783.666,115.334 786.334,106.666 789.000,98.000 C816.256,88.090 829.421,71.078 869.000,71.000 C868.359,81.070 861.244,89.663 853.000,92.000 C853.000,91.000 853.000,90.000 853.000,89.000 C854.000,86.667 855.000,84.333 856.000,82.000 C837.294,82.232 799.325,94.668 793.000,105.000 C787.418,114.118 790.578,130.374 780.000,134.000 C740.829,147.426 757.076,76.828 752.000,59.000 C752.000,59.667 752.000,60.333 752.000,61.000 C745.223,73.164 734.667,133.226 727.000,138.000 C723.000,135.667 719.000,133.333 715.000,131.000 C714.667,128.667 714.333,126.333 714.000,124.000 C712.332,134.215 707.101,138.410 701.000,144.000 C676.875,144.376 671.481,126.230 668.000,126.000 C663.423,134.192 662.693,143.853 654.000,148.000 C640.183,156.391 626.476,140.500 624.000,130.000 C623.333,130.333 622.667,130.667 622.000,131.000 C620.968,137.063 618.879,140.703 614.000,143.000 C608.333,145.710 603.037,143.751 597.000,142.000 C591.572,134.478 586.991,127.430 585.000,116.000 C584.667,108.334 584.333,100.666 584.000,93.000 C580.819,111.121 574.896,130.093 574.000,148.000 C571.667,148.000 569.333,148.000 567.000,148.000 C554.188,141.219 557.333,106.413 556.000,92.000 C555.667,92.000 555.333,92.000 555.000,92.000 C551.660,113.037 542.113,128.517 543.000,152.000 C534.443,152.106 531.663,150.227 527.000,147.000 C526.548,139.255 528.022,119.426 524.000,114.000 C523.000,120.333 522.000,126.667 521.000,133.000 C517.365,132.356 517.973,132.597 516.000,131.000 C519.473,109.644 523.352,83.915 521.000,58.000 C527.710,58.195 532.856,59.589 537.000,62.000 C536.990,77.342 533.989,109.399 540.000,122.000 C544.999,103.669 550.001,85.332 555.000,67.000 C555.667,66.667 556.333,66.333 557.000,66.000 C561.666,66.667 566.334,67.333 571.000,68.000 C571.333,84.998 571.667,102.002 572.000,119.000 C573.534,103.416 579.904,81.152 587.000,69.000 C591.000,69.667 595.000,70.333 599.000,71.000 C600.000,71.667 601.000,72.333 602.000,73.000 C598.629,93.804 592.692,128.993 610.000,139.000 C610.667,138.667 611.333,138.333 612.000,138.000 C619.084,119.656 619.542,94.431 623.000,69.000 C624.667,69.000 626.334,69.000 628.000,69.000 C630.666,69.667 633.334,70.333 636.000,71.000 C641.389,96.530 626.908,126.990 645.000,145.000 C646.666,145.000 648.334,145.000 650.000,145.000 C666.165,122.308 662.256,100.762 662.000,63.000 C654.848,63.389 649.401,63.212 646.000,60.000 C651.666,58.667 657.334,57.333 663.000,56.000 C664.000,45.001 665.000,33.999 666.000,23.000 C666.667,22.667 667.333,22.333 668.000,22.000 C687.281,24.777 680.275,34.710 679.000,53.000 C687.999,51.334 697.001,49.667 706.000,48.000 C706.333,48.667 706.667,49.333 707.000,50.000 C706.667,50.667 706.333,51.333 706.000,52.000 C698.113,55.375 688.460,57.866 678.000,61.000 C675.424,90.062 674.857,128.109 694.000,139.000 C697.000,137.000 700.000,135.000 703.000,133.000 C717.021,98.411 714.317,53.270 711.000,6.000 ZM470.000,23.000 C483.621,22.923 494.645,28.316 503.000,34.000 C507.957,47.720 514.852,107.984 488.000,95.000 C488.000,94.333 488.000,93.667 488.000,93.000 C483.567,71.615 516.809,53.319 487.000,33.000 C469.894,36.062 438.873,71.381 453.000,96.000 C466.728,119.924 510.170,113.480 511.000,151.000 C498.744,177.434 451.941,163.765 438.000,149.000 C438.000,148.667 438.000,148.333 438.000,148.000 C438.333,147.333 438.667,146.667 439.000,146.000 C455.672,150.089 465.978,162.945 490.000,157.000 C492.333,154.334 494.667,151.666 497.000,149.000 C495.478,107.126 393.557,112.452 448.000,42.000 C454.454,33.648 460.975,28.925 470.000,23.000 ZM142.000,25.000 C145.000,25.333 148.000,25.667 151.000,26.000 C151.667,28.666 152.333,31.334 153.000,34.000 C152.000,34.667 151.000,35.333 150.000,36.000 C128.669,39.000 107.331,42.000 86.000,45.000 C86.000,66.331 86.000,87.669 86.000,109.000 C86.333,109.000 86.667,109.000 87.000,109.000 C100.134,104.617 129.480,102.206 133.000,116.000 C132.333,116.333 131.667,116.667 131.000,117.000 C116.335,119.000 101.665,121.000 87.000,123.000 C88.000,135.999 89.000,149.001 90.000,162.000 C92.000,162.000 94.000,162.000 96.000,162.000 C109.827,158.054 129.687,154.165 145.000,157.000 C144.333,158.666 143.667,160.333 143.000,162.000 C119.505,164.726 93.114,177.018 74.000,164.000 C73.000,151.335 72.000,138.665 71.000,126.000 C61.885,129.735 23.674,144.992 21.000,136.000 C27.943,118.630 49.548,113.899 71.000,112.000 C71.000,106.334 71.000,100.666 71.000,95.000 C68.262,85.499 65.766,37.783 68.000,36.000 C92.664,32.334 117.336,28.666 142.000,25.000 ZM296.000,50.000 C300.333,50.333 304.667,50.667 309.000,51.000 C310.000,51.667 311.000,52.333 312.000,53.000 C313.000,69.332 314.000,85.668 315.000,102.000 C315.000,101.333 315.000,100.667 315.000,100.000 C322.496,87.374 324.270,64.590 335.000,55.000 C339.666,56.000 344.334,57.000 349.000,58.000 C347.504,76.404 338.466,117.810 358.000,123.000 C361.725,112.964 365.910,102.544 368.000,90.000 C370.333,89.333 372.667,88.667 375.000,88.000 C380.046,104.818 393.121,121.888 412.000,125.000 C412.000,126.333 412.000,127.667 412.000,129.000 C411.000,130.667 410.000,132.334 409.000,134.000 C389.235,131.944 376.412,115.179 373.000,97.000 C372.667,97.000 372.333,97.000 372.000,97.000 C371.705,110.610 366.189,137.419 347.000,128.000 C333.323,121.287 329.415,92.547 333.000,72.000 C332.667,72.000 332.333,72.000 332.000,72.000 C326.480,90.418 321.147,108.981 315.000,130.000 C309.234,129.894 306.502,128.873 303.000,127.000 C301.667,113.001 300.333,98.999 299.000,85.000 C299.935,105.309 295.623,125.596 278.000,127.000 C265.494,121.775 258.454,110.024 256.000,95.000 C255.667,95.000 255.333,95.000 255.000,95.000 C254.668,108.250 250.556,123.627 241.000,128.000 C214.711,134.206 215.527,103.634 209.000,85.000 C204.858,86.744 199.383,88.259 197.000,92.000 C188.899,109.579 192.129,139.857 169.000,142.000 C140.093,132.172 139.914,98.472 141.000,62.000 C145.333,62.333 149.667,62.667 154.000,63.000 C154.667,64.333 155.333,65.667 156.000,67.000 C148.591,92.132 157.562,127.810 172.000,136.000 C173.000,135.667 174.000,135.333 175.000,135.000 C180.589,120.995 186.974,106.904 189.000,88.000 C180.385,81.847 178.456,69.584 182.000,57.000 C183.000,56.667 184.000,56.333 185.000,56.000 C186.667,56.000 188.334,56.000 190.000,56.000 C198.127,59.924 198.521,71.665 198.000,84.000 C217.480,79.096 215.600,40.637 238.000,31.000 C249.179,27.901 258.685,35.729 266.000,40.000 C266.000,41.333 266.000,42.667 266.000,44.000 C260.073,42.195 255.368,37.090 248.000,40.000 C226.770,48.359 208.980,107.970 236.000,124.000 C255.148,111.196 245.393,75.673 256.000,54.000 C260.666,54.667 265.334,55.333 270.000,56.000 C275.563,80.035 266.359,104.178 281.000,120.000 C282.000,119.333 283.000,118.667 284.000,118.000 C290.206,98.553 294.639,77.606 296.000,50.000 ZM631.000,31.000 C632.666,31.333 634.333,31.667 636.000,32.000 C640.226,42.936 638.786,53.661 633.000,62.000 C628.487,61.785 627.609,61.292 625.000,60.000 C621.520,47.818 623.764,37.835 631.000,31.000 Z"></path> </svg> </div> </footer> <!-- Cloudflare Pages Analytics --><script defer src='https://static.cloudflareinsights.com/beacon.min.js' data-cf-beacon='{"token": "817ee5d2071b46a8b0c783f72c7ab062"}'></script><!-- Cloudflare Pages Analytics --><script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v31edd6df95cf4e85bb4c19e7a9bdbcba1788362987495" integrity="sha512-iIg7k2xntmwu6/uSb5tpc/hySgZc4eoL31yB29W6tJFo2akwjPWcEqnCEdJvGexCL0KEQwVYv5BlowfhVz26hg==" data-cf-beacon='{"version":"2024.11.0","token":"12ba99d101534c1ebadd1996f5f3d16f","r":1,"spa":2}' crossorigin="anonymous"></script>
|
||
</body></html> |