Nowadays, cars fea­ture more elec­tron­ic com­pon­ents than ever, embed­ded sys­tems like brak­ing, accel­er­a­tion, nav­ig­a­tion, com­mu­nic­a­tion, and dozens of oth­ers must per­form flaw­lessly in vari­ous con­di­tion because human life is at stake. With cur­rent, autonom­ous vehicles tech­no­logy devel­op­ment trends, the num­ber of safety crit­ic­al embed­ded sys­tems will only increase and require more attention.

In Codelab, we mostly oper­ate in indus­tries with very high secur­ity stand­ards and have many years of exper­i­ence in Auto­mot­ive pro­jects, there­fore our organ­iz­a­tion­al pro­cesses are aligned to Auto­mot­ive SPICE® stand­ard and focused on con­stant improve­ment. Fix­ing prob­lems quickly is sig­ni­fic­ant but the only thing that can pre­vent mis­takes from hap­pen­ing, is find­ing the root cause and tackle it prop­erly. For Root Cause Ana­lys­is we used to use 5 Whys tech­nique, developed almost a hun­dred years ago by Saki­chi Toy­oda. This is a very pop­u­lar tool, espe­cially in Lean Man­age­ment. How­ever, we quickly real­ized that, regard­less of some advant­ages, this tech­nique seems to be too simplist­ic for our needs. Too often the final answer of invest­ig­a­tion is ‘human error’, too often it entails dis­cour­aging blame cul­ture. We felt the need to find power­ful, effect­ive and socially con­scious tool for post mortem ana­lys­is. We got inspired by Infin­ite Hows meth­od, thor­oughly described by John All­s­paw and also Nick Sten­ning with Jes­sica DeVita.

The meth­od does not simply change one word to anoth­er. Repla­cing Whys with Hows comes primar­ily with a dif­fer­ent mind­set and effort put to ask bet­ter ques­tions, there­fore get more valu­able answers. In the fol­low­ing part, I will present this top­ic with more details.

Infin­ite Hows method

A per­fect start for any invest­ig­a­tion is to ask ‘why’, but in the end, inev­it­ably changes to who is respons­ible. Judging a spe­cif­ic per­son won’t help the pro­ject team with either learn­ing or improving.

Let’s take an example. If we start 5 Whys ana­lys­is with the ques­tion: ‘why the deliv­ery was late?’ we will prob­ably learn the root cause of the prob­lem is either the man­ager doesn’t have suf­fi­cient man­age­ment skills or someone on the team is not skilled or trained enough to deliv­er tasks on time. Yes, train­ing is import­ant, but we don’t need to do a prop­er ana­lys­is to come to this con­clu­sion, and it doesn’t help with under­stand­ing the event, moreover improv­ing, and learn­ing from mis­takes. Ask­ing people why they did some­thing mul­tiple times may put them on the defens­ive and make them speak less frankly, espe­cially when being asked by someone more power­ful in the organization.

When using Infin­ite Hows meth­od we start ask­ing: ‘how did we made the deliv­ery?’ it gives us an oppor­tun­ity to learn how we eval­u­ated the scope of the work, how much the time pres­sure was exper­i­enced, how often deliv­ery delays hap­pen, how the approach for cod­ing and test­ing was chosen, and the list goes on and on.  Ask­ing ‘how’ lets us under­stand the con­di­tions that allowed the fail­ure to hap­pen, gives wider per­spect­ive and more valu­able data. It allows us to com­pre­hend the whole story and find out what was respons­ible for the error. The shift of respons­ib­il­ity from who to what not only helps with under­stand­ing, learn­ing, and mak­ing pro­ject improve­ments but also keeps a respect­ful, open minded and enga­ging work­ing environment.

To work with Infin­ite Hows meth­od, we need to start with under­stand­ing people’s loc­al ration­al­ity.

Loc­al rationality

It is obvi­ous when we con­sider our own actions and decisions that we try to do what makes sense to us at the time. We believe that we do reas­on­able things giv­en know­ledge and under­stand­ing of the prob­lem at a par­tic­u­lar moment. In most cases when we make a decision, we think it’s the best, ration­al way. Oth­er­wise, we wouldn’t have done it. This is known as the ‘loc­al ration­al­ity prin­ciple’. Our ration­al­ity is loc­al impli­citly because its lim­ited to our mind­set, know­ledge, cap­ab­il­it­ies, goals, and to the amount of inform­a­tion that we can handle as well. While usu­ally accept this lim­it­a­tion for ourselves, we often use dif­fer­ent cri­ter­ia for oth­ers. We assume that they should have or could have acted dif­fer­ently, based on our cur­rent, post-incid­ent know­ledge. That’s why we are so eager to look for guilty ones dur­ing fail­ure invest­ig­a­tion. It’s nat­ur­al, human tend­ency to altern­ate solu­tions to life events which already had occurred. But again, while coun­ter­fac­tu­al think­ing is tempt­ing it does not con­vey inform­a­tion about com­plex situ­ation, envir­on­ment, and a prob­lem itself.

Ask­ing bet­ter ques­tions, lead­ing inter­views in a more empath­et­ic man­ner, ana­lys­ing prob­lems from broad­er per­spect­ives is a con­tinu­ous learn­ing pro­cess. There is no simple manu­al. As a res­ult, com­plex ana­lys­is is time-con­sum­ing and doesn’t give a simple answer, how­ever it doesn’t mean a weak ana­lys­is. It is the ana­lys­is that makes us learn and any fail­ure pre­ven­tion depends on that learning.