The blameless postmortem comes from air crash investigation, where it works extremely well.

If people know there is a risk of blame, it changes their behavior. It creates incentives to destroy evidence, or avoid creating it in the first place. It creates incentives to stay inside your organizational and political boundaries rather than reach out to solve problems. Whereas if you have a successful blameless culture it is much easier to find out what actually happened.

Specific to aviation, there are two things that I think are worth looking at and considering adopting versions of:

The NASA ASRS system: https://asrs.arc.nasa.gov/

FAR 91.3: https://www.law.cornell.edu/cfr/text/14/91.3

The first of those is the aviation safety reporting system, which provides explicitly for immunity from sanction for inadvertent violations of FAA regulations (with certain limitations).

The second of those is basically the first aviation law clause for flight crews (after 91.1 which is the "this is what this section of law applies to" and 91.2 which doesn't exist) and gives broad discretion to deviate from any rule [in this part of federal law] as needed to address an emergency.

ASRS is directly and strongly supportive of the overall blameless culture in aviation. 91.3 is moderately supportive of it.

Blameless culture doesn't mean "we seek to not understand who was involved or played a part in the bad outcome", but rather "we seek to not punish them for their involvement, while seeking to understand who, what, why, when, and how in order that we can design a more robust overall system".

Those are often confused.

Why wouldn't you want to punish people who are at fault, especially if there is a pattern of problems or gross negligence that causes harm?

Blame-oriented cultures result in people hiding problems, which makes them worse in the long run.

That doesn’t mean people aren’t accountable for their actions in “blameless” cultures, but problems are first assumed to be the result of systemic issues, deserving to be fixed, rather than individual issues, deserving to be punished.

Exactly. I had a team lead who started working for me a while back. We had scripts that could be run on the web farm to perform different tasks.

Two of them relevant to this story were:

  webservers.regenerate.all.cache.files
  webservers.release-prep.stop.all.services

The first one would refresh all the cached information after a marketing database update. The second would stop all the webservers.

Guy's first day; I'm showing him the ropes; we push the marketing data update and set about regenerating all the cache files by manually picking the correct file from the folder of all possible files. I'm sure we can all guess what happened to make this a story remotely worth telling...

Complete site outage. Completely unnecessary. Completely human error.

Should we blame the guy who clicked on the file that was directly adjacent to the one he intended? Should we blame me as the guy overseeing the training? Or should we change the system so that files that we use multiple times everyday and are safe/innocuous are't right next to an E-stop/EPO button? Or maybe we should change the system so that pushing marketing data refreshes the caches files automatically?

Blameless culture favors the latter actions over the former and tends to make your operation stronger and more resilient over time. The experts (and the novices) who made the mistake can speak freely about what happened and how we might prevent it, without fearing reprisal.

If someone repeatedly kills the site by mistake time after time, despite reasonable safeguards being in place, they should face disciplinary action. But when they make an honest mistake because we left an idling chainsaw laying around on the workbench, it makes no sense to blame them for grabbing it by mistake.

You are conflating criminal acts with engineering problems.

As stated earlier, blameless postmortems are for RCA of a particular incident. If you shoot every engineer who causes a incident you will succeed in having no incidents because no one will bring them up or making any changes for fear of getting shot.

You might want to, but whether you should do it is a separate question of its own.

If you promise people that there will be no blame, no punishment, no nothing, then they may speak more forthrightly. Do you want that honesty or do you prefer to retain the option of punishment?

because in the end the powers at work will make sure that the blame goes to some person turning a wrench instead of finding the real reason and the real source of the blame, most likely a process or inadequacy of redundancy/checks-and-balances would have been the real fix. Pointing at Max over in Wrenching because he left a wrench in the motor because he's been working double shifts for months on end does not fix future issues, and Hank the Replacement will likely make a similar mistake at some point in the future

Same here, never understood the march towards 'blameless' culture - if someone is to blame, they should be blamed; if there is a pattern of mistakes they should be shown the door as quickly as possible.

Are you sure you understand your current stance? Can you explain why your approach is necessarily optimal, with no exceptions?

Because if there is someone who is at fault, their reaction will be to throw someone else under the bus. So you may end up with a situation where the person being blamed isn't actually the person responsible for the accident.

I have worked in companies where the focus was finding who is responsible for failures. The result was that minor incidents were covered up to save bonuses and the problems (in the Problem Management context) that led to them were invisible to the management. When problems are invisible there is a tendency to push into safety margins to cut costs (known as normalisation of deviance) which ultimately leads to uncontrolled incidents.

In my current role I promote a blameless culture and the result is my team proactively raise incidents. We have more incidents than other teams but the incidents are generally controlled and problems are visible, prioritised and closed off. Coincidentally, my teams have record high Mean Times Between Failures and I'm now working with the other teams to fix their safety culture.

The lack of thinking about safety culture in this way is one of the reason that I don't believe most "Software Engineers" should be considered engineers.

To me, "blameless organisation" is about raising the bar for blaming people. It makes you try _really hard_ to blame the process that allowed this to happen: if you really can't... _Then_ we're within the realm of professional negligence/misconduct or performance

Blameless culture is not about dodging responsibility. It’s about that when a process wrongly allowed a human to do X, the process is the issue to fix.

Of course you can go deeper and ask why was this process not done correctly etc but at the end of the day, it’s about actionable changes that ensure mistakes don’t get repeated.

Blaming process for everything is a symptom of this mindset. Not everything is a process issue. Process is the only thing you can blame with this mindset, but it will only fix process issues.

Everything can be a process. If some individual is truly fully responsible for a screwup, what process allowed the person to get that far?

I disagree - if 'everything can be a process' we wouldn't need human judgement anywhere - and clearly we clearly still do need humans in the loop - and the reality is the judgement of humans is not all created equal. Some are better than others.

A process may include human judgement. I don't get your disagreement.

If I as a professional footballer repeatedly foul people, which process is at fault when no one else around me does that?

Unless you just call everything a process: "His childhood was difficult and that's why he fouls people. Let's call his childhood a process."

I think at some point you have to say that some things are not processes, or cannot usefully described as such. Or they devolve into Zeno's paradox.

> Unless you just call everything a process: "His childhood was difficult and that's why he fouls people. Let's call his childhood a process."

Well... attempting to prevent stuff like bullying or domestic violence is a worthwhile goal in itself.

For the example of the soccer player, one might also question other incentives (e.g. bonuses tied to winning games no-matter-what), or why a player with a known history was hired in the first place.

> Well... attempting to prevent stuff like bullying or domestic violence is a worthwhile goal in itself.

Obviously a worthwhile goal, but not a process failure on the part of the football team.

A foul is a statistic that is easily countable. If goals are greater than fouls then it may make sense to keep that footballer anyway.

I hope we aren't using football as an analogy for avionic engineering with 1000's of people.

> If I as a professional footballer repeatedly foul people, which process is at fault when no one else around me does that?

The process that hasn't cut you from the football team.

"The road to hell is paved with good intentions"

I mean in theory, you're absolutely right but so rarely does it ever actually shake out that way. It seems like corporations continue to make the same mistakes while simultaneously being held less and less accountable.

Literally hundreds of people have died due to Boeing's negligence recently and the prevailing opinion seems to be that no one is ultimately going to be held accountable. (at least not meaningfully)

Ideals are great and all but if it results in zero accountability when hundreds of people die, maybe its time for us to re-evaluate.

The blameless culture is about the benefits of not blaming the reports I think. If you manage a team you should see yourself at fault in a sense if something goes wrong just by implication. But you should try not to make it a big deal for respective team member and your higher-ups should try the same for you...

Making it clear who did it does not mean firing that person or making them feel like shit internally, it's a learning process, but the higher up you go the more you should feel bad (presumably you went through the learning process and earning big bucks as a result, so wtf)

> The blameless culture is about the benefits of not blaming the reports I think.

That may have been the case, but their are entire company values that insist on the blameless culture. This certainly sends a message organization wide to all levels that blame is not tolerated.

You are conflating "blameless culture" and blameless retrospectives culture.

You can 100% blame people for doing bad things. But in an engineering incident you want to find the RCA.

In SDE you may find the single git commit that took down everything, it has a author. Fine, there is blame. But why was there no review, no unit tests, no functional tests, QA, etc....

So you fire the engineer but make no other changes and it happens again, how is that helpful?

Blameless culture shouldn't extend to leadership.

Leadership is always to blame if something goes wrong, it's only fair as they will get the credit if things go right. That's the price of leadership.

If the culture is blameless than the CEO's should benefit from that blameless culture as well - (I disagree with this though).

Quite a logical leap to say that everyone in a corp deserves to be held 'blameless' except the CEO - imo, you can't have it both ways.

Perhaps you haven't worked enough in a habitually blaming organization. The problem is that blaming is both easy and often spurious. So in the end you still often run into the same problem: a bunch of people pointing fingers at each other and no one owning anything. If anyone takes a fall because of it that's often more a measure of their political power rather than their actual culpability. It also fails to address dysfunctional organizational processes that make individual errors more likely, because everyone is more concerned with finding a single scapegoat or small group of them.

Maybe we need a new way of expressing "blameless" that still expresses that personal responsibilty for quality work should be expected, but that punitive blame politics are simply a very ineffective way of encouraging that or finding the truth when problems inevitably occur.