Failure Scenario Review¶
Narrative failure-analysis method — instantiates Failure Mode Anticipation
A structured walkthrough of a single failure as a story — the mode, the chain of causes that triggers it, and the cascade of effects it produces across time, actors, and dependencies.
Failure Scenario Review takes a single way the system could fail and walks it forward as a story: what starts it, what happens next, who is doing what, what depends on what, and how the consequences cascade over time. Its distinguishing contribution among its siblings is the temporal, interaction-focused narrative. Where a tabular method scores failures one row at a time and an incident review counts what has already happened, the scenario review follows one failure mode from its triggering causes through the chain of effects it sets off across handoffs, and in doing so it surfaces the interaction failures — the ones where two things go wrong together, or where a fix in one step becomes a trap two steps later — that a row-by-row table flattens into separate, harmless-looking lines. Its unit of analysis is the unfolding sequence, not the entry.
Example¶
A site-reliability team runs a failure scenario review on a new multi-region deployment before cutover. They pick one mode — the primary region degrades and traffic fails over to the secondary — and walk it forward. Step one: the primary's latency climbs and health checks start failing. Step two: automated failover triggers as designed. Step three, the twist nobody had on a checklist: a months-old configuration drift means the secondary is provisioned for only half the primary's peak load. Step four: the secondary saturates, requests time out, clients retry, and the retry storm drives the secondary down harder than the original degradation. Step five: a partial outage becomes a total one. Walking the story reveals the interaction — drift plus automatic failover plus aggressive client retries — that no single line item would have caught, and it names the exact point in the sequence where a capacity pre-check could break the chain. That, not a score, is the review's product: a causal narrative with a place to intervene.
How it works¶
- Pick one failure mode and set the scene. Fix the operating context, the actors, and the starting state precisely enough that "and then" has a definite meaning.
- Walk it forward step by step. Advance through time and across handoffs, asking at each step what else is in play and what depends on what — the discipline that surfaces coincident and cascading failures.
- Trace effects as a cascade, not a single outcome. Follow the consequences downstream through dependencies rather than recording one "effect," because the damage usually compounds.
- Mark the breakable links. Note where in the sequence a single change would have interrupted the chain — the narrative's payoff for redesign.
Tuning parameters¶
- Scenario selection — which few failures to walk deeply. Choosing by diversity of failure path covers more of the space than choosing by whichever story is most vivid.
- Step granularity — coarse beats versus fine-grained steps. Fine steps expose subtle interactions but cost time and can bog the walk down.
- Walk direction — forward from a trigger versus backward from the harm. Forward finds cascades; backward is better when the feared outcome is fixed and the causes are unknown.
- Participant mix — designers alone versus operators and maintainers who actually know the handoffs. The interaction failures live in the handoffs, so the people who work them are what make the walk realistic.
- Adversarial injection — whether a facilitator deliberately perturbs a step to test the chain's fragility.
When it helps, and when it misleads¶
Its strength is that it catches what tables miss: timing, coincidence, handoff brittleness, and the fix-becomes-trap interactions that only appear when a failure is followed as a sequence. It also produces something memorable — a concrete causal chain a team can reason about and point to — rather than an abstract entry.[n1]
Its signature failure mode is that you only ever analyze the handful of scenarios you thought to imagine, and a well-told story can feel far likelier than it is: narrative plausibility is not probability, and a vivid, gripping scenario can pull disproportionate investment toward a failure that will almost never happen. The classic misuse is treating a compelling walk as a calibrated forecast. The guarding discipline is to select scenarios by the diversity of the failure paths they exercise rather than by dramatic appeal, and to pair the review with a method that bounds frequency and priority so the vivid story does not crowd out the common one.
How it implements the components¶
failure_mode— names the specific way the function fails that the walk is built around, concrete enough to have a first step and a sequence.failure_cause— traces the chain of triggering conditions and interactions that set the failure in motion, including the coincident causes a single-cause account would miss.failure_effect— follows the consequences downstream as a cascade across time, actors, and dependencies, rather than recording one terminal outcome.
It does not rank or score what it finds (risk_priority, severity_scale) — that quantified triage is Failure Modes and Effects Analysis, its nearest tabular twin — and it does not ground the story in observed frequency (likelihood_estimate), which is Incident Pattern Review; the scenario is a reasoned narrative, not a base rate.
Related¶
- Instantiates: Failure Mode Anticipation — the review supplies the causal chains and breakable links the other mechanisms rank, own, and control.
- Consumes: Incident Pattern Review — real past incidents seed the most credible scenarios to walk.
- Sibling mechanisms: Design Review · Failure Modes and Effects Analysis · Incident Pattern Review · Safety Case · Fault Tree Analysis · Hazard Analysis · Premortem Workshop · Risk Register
Editorial Notes¶
Form Classification¶
Form family: Assessment, Review & Assurance
Rationale: The structured walkthrough evaluates one existing or postulated failure chain across time, actors, handoffs, dependencies, cascades, and breakable links.
Nearest alternative: Experiment, Test & Rehearsal — The story is advanced step by step, but no failure is actively staged; the mechanism reviews a scenario to produce findings.
Review outcome: Adjudicated after independent review; high confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Walking through failure modes, causal chains, and cascading effects arises from safety and reliability engineering.
Related originating lineages:
- Computer Science & Software Engineering — Site-reliability game days and failure-scenario exercises materially shape distributed-system applications.
- Disaster Management & Risk Reduction — Scenario-based cascading-risk analysis materially developed multi-actor temporal walkthroughs.
- Futurism & Strategic Foresight — Scenario methods materially shape the narrative time-sequenced review form.
Review resolution: Both reviewers agree that engineering_design is primary. I retain futurism_foresight, computer_science, disaster_management only as formative origin lineages; cross_disciplinary_synthesis is appropriate because the final form materially combines the agreed primary with the retained formative lineages. Reach is multi_domain because the structure transfers across several fields but is not a near-universal human pattern, an applicability judgment kept separate from provenance. Encyclopedia synthesis is true because the exact generalized artifact is an encyclopedia-authored combination or refinement. No unresolved historical ambiguity remains after reconciling the secondary fields.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
[n1] James Reason's Swiss cheese model of accident causation holds that serious failures happen when latent weaknesses in successive layers of defense momentarily line up — the "holes" align. A scenario walk is how those alignments are found before the fact: it follows one path through the layers and asks where the holes coincide. ↩