Root Cause Analysis AI - AiPro Institute\u2122<\/title>\n <style>\n *{margin:0;padding:0;box-sizing:border-box}\n body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;line-height:1.6;color:#333;background:#fff;padding:2rem 1rem}\n .container{max-width:900px;margin:0 auto}\n .page-title{text-align:center;font-size:2.5rem;font-weight:700;background:linear-gradient(135deg,#667eea 0%,#764ba2 100%);-webkit-background-clip:text;-webkit-text-fill-color:transparent;background-clip:text;margin-bottom:2rem}\n .card{background:#fff;border-radius:12px;box-shadow:0 4px 6px rgba(0,0,0,.1);overflow:hidden;margin-bottom:2rem}\n .card-header{background:linear-gradient(135deg,#667eea 0%,#764ba2 100%);color:#fff;padding:2rem}\n .card-header h1{font-size:2rem;margin-bottom:.5rem}\n .card-header .subtitle{font-size:1.1rem;opacity:.95}\n .meta-badges,.tool-badges{display:flex;gap:.75rem;margin-top:1rem;flex-wrap:wrap}\n .badge{background:rgba(255,255,255,.2);padding:.4rem .9rem;border-radius:20px;font-size:.9rem;backdrop-filter:blur(10px)}\n .tool-badge{background:transparent;border:1px solid rgba(255,255,255,.4);padding:.4rem .9rem;border-radius:20px;font-size:.85rem}\n .card-body{padding:2.5rem}\n .section-title-container{display:flex;justify-content:space-between;align-items:center;margin:2.5rem 0 1.25rem 0}\n .section-title-container:first-child{margin-top:0}\n .section-title{font-size:1.75rem;color:#764ba2;border-left:4px solid #764ba2;padding-left:1rem;margin:0}\n .copy-button{background:linear-gradient(135deg,#667eea 0%,#764ba2 100%);color:#fff;border:none;padding:.6rem 1.5rem;border-radius:6px;cursor:pointer;font-size:.95rem;font-weight:500;transition:opacity .3s}\n .copy-button:hover{opacity:.9}\n .prompt-box{background:#f8f9fa;border:1px solid #dee2e6;border-radius:8px;padding:1.5rem;margin:1.25rem 0;font-family:'Courier New',monospace;font-size:.95rem;line-height:1.6;white-space:pre-wrap;overflow-x:auto}\n .placeholder{color:#fd7e14;font-weight:bold}\n .tip-box{background:#fff9e6;border-left:4px solid #ffc107;padding:1.25rem;margin:1.25rem 0;border-radius:4px}\n .tip-box strong{color:#f57c00}\n h3{color:#764ba2;font-size:1.35rem;margin:2rem 0 1rem 0}\n p{margin-bottom:1rem;line-height:1.8}\n ul,ol{margin-left:2rem;margin-bottom:1rem}\n li{margin-bottom:.5rem;line-height:1.8}\n .example-output{background:#f0f8ff;border:2px solid #4a90e2;border-radius:8px;padding:1.5rem;margin:1.25rem 0}\n .example-output h4{color:#4a90e2;margin-bottom:1rem}\n .chain-step{background:#f8f9fa;border-left:4px solid #667eea;padding:1.5rem;margin:1.5rem 0;border-radius:4px}\n .chain-step h4{color:#667eea;margin-bottom:.75rem}\n .footer{background:#f8f9fa;padding:2rem;margin-top:2rem;border-radius:8px;display:flex;justify-content:space-around;align-items:center;flex-wrap:wrap;gap:1.5rem}\n .footer-stat{text-align:center}\n .footer-stat-value{font-size:1.75rem;font-weight:700;color:#764ba2}\n .footer-stat-label{color:#666;font-size:.95rem}\n @media (max-width:768px){.page-title{font-size:1.75rem}.card-header h1{font-size:1.5rem}.card-body{padding:1.5rem}.section-title{font-size:1.35rem}.section-title-container{flex-direction:column;align-items:flex-start;gap:1rem}.footer{flex-direction:column}}\n <\/style>\n<\/head>\n<body>\n <div class=\"container\">\n <h1 class=\"page-title\">Root Cause Analysis AI<\/h1>\n\n <div class=\"card\">\n <div class=\"card-header\">\n <h1>Root Cause Analysis AI<\/h1>\n <p class=\"subtitle\">Problem Solving & Analysis<\/p>\n <div class=\"meta-badges\">\n <span class=\"badge\">\u23f1\ufe0f 25-40 minutes<\/span>\n <span class=\"badge\">\ud83d\udcca Advanced<\/span>\n <\/div>\n <div class=\"tool-badges\">\n <span class=\"tool-badge\">ChatGPT<\/span>\n <span class=\"tool-badge\">Claude<\/span>\n <span class=\"tool-badge\">Gemini<\/span>\n <span class=\"tool-badge\">Perplexity<\/span>\n <span class=\"tool-badge\">Grok<\/span>\n <\/div>\n <\/div>\n\n <div class=\"card-body\">\n <div class=\"section-title-container\">\n <h2 class=\"section-title\">The Prompt<\/h2>\n <button class=\"copy-button\" onclick=\"copyPrompt()\">\ud83d\udccb Copy Prompt<\/button>\n <\/div>\n\n <div class=\"prompt-box\" id=\"promptContent\">You are a senior incident investigator and root cause analysis (RCA) facilitator. Perform a rigorous RCA for the incident\/problem below.\n\n<span class=\"placeholder\">[PROBLEM_STATEMENT]<\/span> (1-3 sentences)\n\n<span class=\"placeholder\">[IMPACT_SUMMARY]<\/span> (e.g., \"5% checkout failures for 2 hours\", \"data loss of 120 records\", \"SLA breach\")\n\n<span class=\"placeholder\">[TIMELINE_EVENTS]<\/span> (bullet list with timestamps; include detection, mitigation, changes, alerts)\n\n<span class=\"placeholder\">[SYSTEM_CONTEXT]<\/span> (architecture notes, dependencies, teams, environments)\n\n<span class=\"placeholder\">[EVIDENCE]<\/span> (logs, metrics, traces, tickets, screenshots; paste excerpts)\n\n<span class=\"placeholder\">[CONSTRAINTS]<\/span> (e.g., \"no code changes until change window\", \"must keep service live\")\n\nUse the R.O.O.T. Framework:\n\n**R - Reconstruct** the timeline and failure modes (what happened, when, and where)\n**O - Observe** evidence and anomalies (metrics, logs, diffs, config)\n**O - Offset** assumptions with counter-hypotheses (at least 3 competing causes)\n**T - Treat** root causes with corrective and preventive actions (CAPA)\n\nDELIVER 12 SECTIONS:\n\n\u2713 1) Executive Summary (what happened, impact, duration)\n\u2713 2) Customer\/Business Impact (metrics + dollars\/time)\n\u2713 3) Systems Affected (services, dependencies, blast radius)\n\u2713 4) Timeline (minute-level reconstruction)\n\u2713 5) Primary Failure Mode (technical explanation)\n\u2713 6) Contributing Factors (process + tech + human)\n\u2713 7) Root Cause Statement (single sentence: \"Because X, Y happened, leading to Z\")\n\u2713 8) 5 Whys (complete chain)\n\u2713 9) Fault Tree \/ Cause Map (structured list)\n\u2713 10) Counterfactual Analysis (what would have prevented impact)\n\u2713 11) Corrective Actions (next 24h) + Preventive Actions (30\/60\/90 days)\n\u2713 12) Verification Plan (how we know fixes work)\n\nPROMPT STRUCTURE REQUIREMENTS:\n- Context setting (system + constraints)\n- Required Inputs section (list what you need if missing)\n- Output format (the 12 sections)\n- Framework principles (5-7) you will follow\n- Deliverable checklist with \u2713\n\nRULES:\n- Do not blame individuals; focus on system and process\n- Quantify uncertainty and label assumptions\n- Include 3+ plausible hypotheses and show elimination logic\n- Propose metrics\/alerts that would have caught it earlier\n<\/div>\n\n <div class=\"tip-box\"><strong>\ud83d\udca1 Pro Tip:<\/strong> The fastest RCA comes from competing hypotheses. Force yourself to write 3\u20135 plausible causes first, then eliminate them with evidence\u2014this prevents anchoring and \u201cthe first plausible story wins.\u201d<\/div>\n\n <div class=\"section-title-container\"><h2 class=\"section-title\">The Logic<\/h2><\/div>\n\n <h3>1. Timeline Reconstruction Prevents \u201cStory Bias\u201d and Makes Causality Testable<\/h3>\n <p><strong>WHY IT WORKS:<\/strong> Teams often jump to causal explanations before agreeing on what happened. A minute-level timeline aligns everyone on sequence: change events, alerts, traffic shifts, dependency failures, and mitigation steps. Once time ordering is explicit, many hypotheses become falsifiable (\u201ccould not be the cause because it happened after the impact started\u201d). This reduces narrative drift and the tendency to pick the most confident storyteller\u2019s explanation. Timeline discipline also surfaces \u201chidden interventions\u201d (manual restarts, feature flags, backfills) that quietly change system behavior. In complex incidents, timeline errors are common and can waste hours.<\/p>\n <p><strong>EXAMPLE:<\/strong> Suppose checkout failures began at 10:02, but an engineer remembers \u201cwe deployed at 10:15,\u201d so the team blames the deploy. A reconstructed timeline shows a database connection pool saturation spike at 10:01, triggered by a traffic burst from an email campaign at 09:59. The deploy at 10:15 was actually mitigation, not cause. In postmortems, teams who build a timeline first typically reduce false attribution and produce higher-quality corrective actions (monitoring and scaling) instead of superficial fixes (\u201crollback\u201d) that don\u2019t address the real trigger.<\/p>\n\n <h3>2. Competing Hypotheses Reduce Anchoring and Increase RCA Accuracy<\/h3>\n <p><strong>WHY IT WORKS:<\/strong> Human cognition anchors on the first plausible explanation, then selectively searches for confirming evidence. Requiring 3\u20135 competing hypotheses forces disconfirmation: you must ask \u201cwhat evidence would prove this wrong?\u201d This mirrors scientific reasoning and significantly improves RCA accuracy for ambiguous failures. It also prevents blame-driven hypotheses (\u201cperson X changed something\u201d) and shifts toward system mechanisms. In reliability engineering, hypothesis-driven debugging reduces time-to-resolution and post-incident recurrence because fixes align with true mechanisms.<\/p>\n <p><strong>EXAMPLE:<\/strong> Incident: API latency doubled. Hypothesis A: bad deploy. Hypothesis B: dependency timeout (payment provider). Hypothesis C: database index regression. Hypothesis D: network packet loss. You then map each to observable evidence: deploy diff timestamps, dependency error codes, DB query plans, packet loss metrics. If payment timeouts began before any deploy and coincide with provider 5xx errors, Hypothesis B becomes primary. This avoids deploying \u201cfixes\u201d that do nothing. Teams that institutionalize hypothesis lists often see fewer repeat incidents because they test multiple failure channels rather than \u201cfix the obvious.\u201d<\/p>\n\n <h3>3. Fault Trees Expose Multi-Factor Failures Where No Single Cause Explains the Incident<\/h3>\n <p><strong>WHY IT WORKS:<\/strong> Many incidents are not single-point failures; they are cascades: a traffic spike + missing rate limits + slow DB queries + insufficient autoscaling. A fault tree or cause map makes AND\/OR relationships explicit, revealing that removing any one contributing factor might have prevented impact. This helps prioritize fixes: you can choose the cheapest \u201cbreak the chain\u201d action even if it\u2019s not the deepest root cause. Fault trees also reduce political conflict because they show systemic interaction rather than a single scapegoat.<\/p>\n <p><strong>EXAMPLE:<\/strong> Checkout outage: OR node \u201cpayment gateway unreachable\u201d OR \u201cinternal service crashed.\u201d Internal service crash itself is an AND node: \u201cthread pool exhaustion\u201d AND \u201cretry storm\u201d AND \u201cno circuit breaker.\u201d The root isn\u2019t just \u201cpayment gateway slow\u201d; it\u2019s also \u201cwe retried without backoff and had no bulkheads.\u201d CAPA then includes circuit breakers, capped retries, and dependency budgets. Organizations using cause maps tend to improve resilience faster because they address multiple weak links rather than arguing over \u201cthe one true cause.\u201d<\/p>\n\n <h3>4. Counterfactual Analysis Turns Postmortems Into Resilience Design<\/h3>\n <p><strong>WHY IT WORKS:<\/strong> \u201cWhat caused it?\u201d is only half the value; \u201cwhat would have prevented customer impact?\u201d yields actionable resilience investments. Counterfactuals force you to evaluate safeguards: could alerts have fired earlier? Could rate limiting have reduced blast radius? Could feature flags have enabled graceful degradation? This shifts output from explanation to prevention. Importantly, counterfactuals also expose when root cause removal is not enough\u2014e.g., even if you fix the bug, another bug could still cause outage unless safeguards exist.<\/p>\n <p><strong>EXAMPLE:<\/strong> If a cache stampede caused DB overload, the counterfactual might be \u201crequest coalescing\u201d or \u201cstale-while-revalidate\u201d caching. If a bad deploy caused errors, the counterfactual might be \u201ccanary + automated rollback.\u201d If a dependency failed, counterfactual could be \u201ccircuit breaker + fallback response.\u201d Teams that include counterfactuals often reduce recurrence because they add layered defenses rather than only patching the specific bug that happened this time.<\/p>\n\n <h3>5. CAPA with Ownership and Deadlines Prevents \u201cPostmortem Theater\u201d<\/h3>\n <p><strong>WHY IT WORKS:<\/strong> Postmortems often end with vague actions (\u201cimprove monitoring\u201d) that never ship. CAPA (Corrective and Preventive Actions) becomes effective when actions are concrete, prioritized, assigned, and time-bound (24h, 30\/60\/90 days). Splitting corrective vs preventive ensures immediate stabilization plus long-term systemic improvement. Adding verification plans (\u201chow will we know it\u2019s fixed?\u201d) prevents checkbox work. Operational excellence programs show that action specificity and accountability are the strongest predictors of reduced repeat incidents.<\/p>\n <p><strong>EXAMPLE:<\/strong> Instead of \u201cadd alerts,\u201d specify: \u201cCreate alert: checkout 5xx rate > 1% for 5 minutes (SEV-2), route to on-call; add dependency latency alert for payment provider p95 > 800ms; add saturation alert for DB connections > 85% for 10 minutes.\u201d Assign owners and due dates. For prevention: \u201cImplement circuit breaker for payment provider with exponential backoff; canary deploy with auto-rollback; run quarterly load test.\u201d Teams that do this typically see fewer \u201cwe already discussed this last time\u201d frustrations and measurable stability improvements.<\/p>\n\n <h3>6. Verification Plans Close the Loop and Prevent Recurrence<\/h3>\n <p><strong>WHY IT WORKS:<\/strong> Fixes can be incorrect or incomplete. Verification ensures you validate changes with tests, monitoring, and experiments. The verification plan defines: how to reproduce the failure, what metrics should change, what alarms should fire, and what success looks like. This is essential for confidence in high-stakes systems. Without verification, you risk \u201cfixing the wrong thing\u201d and learning only after the next incident.<\/p>\n <p><strong>EXAMPLE:<\/strong> If the incident involved DB connection exhaustion, verification might include: load test that simulates peak traffic; verify connection pool remains < 80%; verify p95 latency stays under target; verify circuit breaker trips properly when provider slows; verify auto-scaling triggers before saturation. In software reliability, teams that verify CAPA reduce repeat incidents substantially because they validate resilience rather than assuming it.<\/p>\n\n <div class=\"section-title-container\"><h2 class=\"section-title\">Example Output Preview<\/h2><\/div>\n <div class=\"example-output\">\n <h4>Sample: RCA for \u201cCheckout Failures Spike\u201d (Realistic Metrics)<\/h4>\n <p><strong>Impact:<\/strong> 4.8% checkout requests failed (HTTP 502\/504) for 118 minutes (10:02\u201312:00). Estimated 2,960 failed checkouts; projected lost revenue $142,000 (avg order $48). SLA breach: availability 99.71% for the day (target 99.9%).<\/p>\n <p><strong>Primary Failure Mode:<\/strong> Payment-service thread pool exhaustion due to retry storm against slow payment gateway; retries amplified load 3.2\u00d7. DB connection pool hit 100% at 10:07, causing cascading timeouts across checkout pipeline.<\/p>\n <p><strong>Contributing Factors:<\/strong> (1) No circuit breaker on payment gateway, (2) Retry policy lacked jitter\/backoff, (3) Autoscaling triggered on CPU only (missed saturation), (4) No alert on dependency latency, (5) Email campaign caused traffic +22% without capacity review.<\/p>\n <p><strong>Counterfactual:<\/strong> Circuit breaker + capped retries would have reduced error rate to <0.5% and limited impact to <10 minutes; saturation alert on DB connections >85% would have detected 14 minutes earlier.<\/p>\n <p><strong>CAPA (Next 24h):<\/strong> Add capped retries (max 1), increase pool sizes safely, add alerts on dependency p95 > 800ms. <strong>30\/60\/90:<\/strong> circuit breakers, bulkheads, canary deploys, quarterly load tests.<\/p>\n <\/div>\n\n <div class=\"section-title-container\"><h2 class=\"section-title\">Prompt Chain Strategy<\/h2><\/div>\n <div class=\"chain-step\"><h4>Step 1: RCA Draft + Hypotheses<\/h4><p><strong>Prompt:<\/strong> Use the main RCA prompt with timeline and evidence.<\/p><p><strong>Expected Output:<\/strong> Full RCA report (5,000\u20137,000 words) with hypotheses, elimination logic, and CAPA.<\/p><\/div>\n <div class=\"chain-step\"><h4>Step 2: CAPA Implementation Plan<\/h4><p><strong>Prompt:<\/strong> \u201cTurn the CAPA list into Jira-ready tasks: owner roles, estimates, dependencies, success criteria, and rollout plan.\u201d<\/p><p><strong>Expected Output:<\/strong> Execution plan that teams can implement immediately.<\/p><\/div>\n <div class=\"chain-step\"><h4>Step 3: Prevention via GameDay<\/h4><p><strong>Prompt:<\/strong> \u201cDesign a GameDay exercise to simulate recurrence. Include failure injection steps, expected alarms, and pass\/fail.\u201d<\/p><p><strong>Expected Output:<\/strong> A resilience drill that validates prevention mechanisms.<\/p><\/div>\n\n <div class=\"section-title-container\"><h2 class=\"section-title\">Human-in-the-Loop Refinements<\/h2><\/div>\n <h3>Require Evidence Tags for Every Claim<\/h3>\n <p>Force every causal statement to cite evidence (log line, metric, trace). <strong>Technique:<\/strong> tag claims as EVIDENCE \/ INFERENCE \/ ASSUMPTION. This reduces speculation and speeds consensus.<\/p>\n <h3>Run a \u201cDisconfirming Evidence\u201d Round<\/h3>\n <p>Ask each participant to present one piece of evidence that contradicts the leading hypothesis. <strong>Technique:<\/strong> 10-minute round-robin before finalizing root cause.<\/p>\n <h3>Separate \u201cTrigger\u201d From \u201cRoot Cause\u201d<\/h3>\n <p>Triggers (traffic spike) are not the same as root causes (no rate limiting). <strong>Technique:<\/strong> document both so fixes address prevention, not just avoiding triggers.<\/p>\n <h3>Quantify Uncertainty Explicitly<\/h3>\n <p>When logs are missing, state confidence levels and what data would raise confidence. <strong>Technique:<\/strong> add a \u201cmissing evidence\u201d section and a data collection action.<\/p>\n <h3>Assign CAPA Owners Before the Postmortem Ends<\/h3>\n <p>Convert learnings into action. <strong>Technique:<\/strong> every CAPA item must have an owner role + due date + verification metric.<\/p>\n <h3>Review Repeat Incidents Quarterly<\/h3>\n <p>Track recurrence themes (timeouts, retries, bad deploys). <strong>Technique:<\/strong> quarterly reliability review that aggregates RCAs into systemic roadmaps.<\/p>\n\n <div class=\"footer\">\n <div class=\"footer-stat\"><div class=\"footer-stat-value\">4.9\u2605<\/div><div class=\"footer-stat-label\">Average Rating<\/div><\/div>\n <div class=\"footer-stat\"><div class=\"footer-stat-value\">2,118<\/div><div class=\"footer-stat-label\">Times Copied<\/div><\/div>\n <div class=\"footer-stat\"><div class=\"footer-stat-value\">169<\/div><div class=\"footer-stat-label\">Reviews<\/div><\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n\n <script>\n function copyPrompt(){\n const promptContent=document.getElementById('promptContent').innerText;\n navigator.clipboard.writeText(promptContent).then(()=>{\n const button=document.querySelector('.copy-button');\n const originalText=button.innerHTML;\n button.innerHTML='\u2713 Copied!';\n setTimeout(()=>{button.innerHTML=originalText;},2000);\n }).catch(err=>console.error('Failed to copy text: ',err));\n }\n <\/script>\n<\/body>\n<\/html>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>Root Cause Analysis AI – AiPro Institute\u2122 Root Cause Analysis AI Root Cause Analysis AI Problem Solving & Analysis \u23f1\ufe0f 25-40 minutes \ud83d\udcca Advanced ChatGPT Claude Gemini Perplexity Grok The Prompt \ud83d\udccb Copy Prompt You are a senior incident investigator and root cause analysis (RCA) facilitator. Perform a rigorous RCA for the incident\/problem below. [PROBLEM_STATEMENT]…<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[173],"tags":[],"class_list":["post-5674","post","type-post","status-publish","format-standard","hentry","category-problem-solving-analysis"],"acf":[],"_links":{"self":[{"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/posts\/5674","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/comments?post=5674"}],"version-history":[{"count":4,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/posts\/5674\/revisions"}],"predecessor-version":[{"id":5678,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/posts\/5674\/revisions\/5678"}],"wp:attachment":[{"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/media?parent=5674"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/categories?post=5674"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/tags?post=5674"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

\n\t\t\t\t\t\t

\n\t\t\t\t\t

\n\t\t\t

\n\t\t\t\t\t\t

\n\t\t\t\t\t\n\n\n \n \n Root Cause Analysis AI - AiPro Institute\u2122<\/title>\n <style>\n *{margin:0;padding:0;box-sizing:border-box}\n body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'Helvetica Neue',Arial,sans-serif;line-height:1.6;color:#333;background:#fff;padding:2rem 1rem}\n .container{max-width:900px;margin:0 auto}\n .page-title{text-align:center;font-size:2.5rem;font-weight:700;background:linear-gradient(135deg,#667eea 0%,#764ba2 100%);-webkit-background-clip:text;-webkit-text-fill-color:transparent;background-clip:text;margin-bottom:2rem}\n .card{background:#fff;border-radius:12px;box-shadow:0 4px 6px rgba(0,0,0,.1);overflow:hidden;margin-bottom:2rem}\n .card-header{background:linear-gradient(135deg,#667eea 0%,#764ba2 100%);color:#fff;padding:2rem}\n .card-header h1{font-size:2rem;margin-bottom:.5rem}\n .card-header .subtitle{font-size:1.1rem;opacity:.95}\n .meta-badges,.tool-badges{display:flex;gap:.75rem;margin-top:1rem;flex-wrap:wrap}\n .badge{background:rgba(255,255,255,.2);padding:.4rem .9rem;border-radius:20px;font-size:.9rem;backdrop-filter:blur(10px)}\n .tool-badge{background:transparent;border:1px solid rgba(255,255,255,.4);padding:.4rem .9rem;border-radius:20px;font-size:.85rem}\n .card-body{padding:2.5rem}\n .section-title-container{display:flex;justify-content:space-between;align-items:center;margin:2.5rem 0 1.25rem 0}\n .section-title-container:first-child{margin-top:0}\n .section-title{font-size:1.75rem;color:#764ba2;border-left:4px solid #764ba2;padding-left:1rem;margin:0}\n .copy-button{background:linear-gradient(135deg,#667eea 0%,#764ba2 100%);color:#fff;border:none;padding:.6rem 1.5rem;border-radius:6px;cursor:pointer;font-size:.95rem;font-weight:500;transition:opacity .3s}\n .copy-button:hover{opacity:.9}\n .prompt-box{background:#f8f9fa;border:1px solid #dee2e6;border-radius:8px;padding:1.5rem;margin:1.25rem 0;font-family:'Courier New',monospace;font-size:.95rem;line-height:1.6;white-space:pre-wrap;overflow-x:auto}\n .placeholder{color:#fd7e14;font-weight:bold}\n .tip-box{background:#fff9e6;border-left:4px solid #ffc107;padding:1.25rem;margin:1.25rem 0;border-radius:4px}\n .tip-box strong{color:#f57c00}\n h3{color:#764ba2;font-size:1.35rem;margin:2rem 0 1rem 0}\n p{margin-bottom:1rem;line-height:1.8}\n ul,ol{margin-left:2rem;margin-bottom:1rem}\n li{margin-bottom:.5rem;line-height:1.8}\n .example-output{background:#f0f8ff;border:2px solid #4a90e2;border-radius:8px;padding:1.5rem;margin:1.25rem 0}\n .example-output h4{color:#4a90e2;margin-bottom:1rem}\n .chain-step{background:#f8f9fa;border-left:4px solid #667eea;padding:1.5rem;margin:1.5rem 0;border-radius:4px}\n .chain-step h4{color:#667eea;margin-bottom:.75rem}\n .footer{background:#f8f9fa;padding:2rem;margin-top:2rem;border-radius:8px;display:flex;justify-content:space-around;align-items:center;flex-wrap:wrap;gap:1.5rem}\n .footer-stat{text-align:center}\n .footer-stat-value{font-size:1.75rem;font-weight:700;color:#764ba2}\n .footer-stat-label{color:#666;font-size:.95rem}\n @media (max-width:768px){.page-title{font-size:1.75rem}.card-header h1{font-size:1.5rem}.card-body{padding:1.5rem}.section-title{font-size:1.35rem}.section-title-container{flex-direction:column;align-items:flex-start;gap:1rem}.footer{flex-direction:column}}\n <\/style>\n<\/head>\n<body>\n <div class=\"container\">\n <h1 class=\"page-title\">Root Cause Analysis AI<\/h1>\n\n <div class=\"card\">\n <div class=\"card-header\">\n <h1>Root Cause Analysis AI<\/h1>\n <p class=\"subtitle\">Problem Solving & Analysis<\/p>\n <div class=\"meta-badges\">\n <span class=\"badge\">\u23f1\ufe0f 25-40 minutes<\/span>\n <span class=\"badge\">\ud83d\udcca Advanced<\/span>\n <\/div>\n <div class=\"tool-badges\">\n <span class=\"tool-badge\">ChatGPT<\/span>\n <span class=\"tool-badge\">Claude<\/span>\n <span class=\"tool-badge\">Gemini<\/span>\n <span class=\"tool-badge\">Perplexity<\/span>\n <span class=\"tool-badge\">Grok<\/span>\n <\/div>\n <\/div>\n\n <div class=\"card-body\">\n <div class=\"section-title-container\">\n <h2 class=\"section-title\">The Prompt<\/h2>\n <button class=\"copy-button\" onclick=\"copyPrompt()\">\ud83d\udccb Copy Prompt<\/button>\n <\/div>\n\n <div class=\"prompt-box\" id=\"promptContent\">You are a senior incident investigator and root cause analysis (RCA) facilitator. Perform a rigorous RCA for the incident\/problem below.\n\n<span class=\"placeholder\">[PROBLEM_STATEMENT]<\/span> (1-3 sentences)\n\n<span class=\"placeholder\">[IMPACT_SUMMARY]<\/span> (e.g., \"5% checkout failures for 2 hours\", \"data loss of 120 records\", \"SLA breach\")\n\n<span class=\"placeholder\">[TIMELINE_EVENTS]<\/span> (bullet list with timestamps; include detection, mitigation, changes, alerts)\n\n<span class=\"placeholder\">[SYSTEM_CONTEXT]<\/span> (architecture notes, dependencies, teams, environments)\n\n<span class=\"placeholder\">[EVIDENCE]<\/span> (logs, metrics, traces, tickets, screenshots; paste excerpts)\n\n<span class=\"placeholder\">[CONSTRAINTS]<\/span> (e.g., \"no code changes until change window\", \"must keep service live\")\n\nUse the R.O.O.T. Framework:\n\n**R - Reconstruct** the timeline and failure modes (what happened, when, and where)\n**O - Observe** evidence and anomalies (metrics, logs, diffs, config)\n**O - Offset** assumptions with counter-hypotheses (at least 3 competing causes)\n**T - Treat** root causes with corrective and preventive actions (CAPA)\n\nDELIVER 12 SECTIONS:\n\n\u2713 1) Executive Summary (what happened, impact, duration)\n\u2713 2) Customer\/Business Impact (metrics + dollars\/time)\n\u2713 3) Systems Affected (services, dependencies, blast radius)\n\u2713 4) Timeline (minute-level reconstruction)\n\u2713 5) Primary Failure Mode (technical explanation)\n\u2713 6) Contributing Factors (process + tech + human)\n\u2713 7) Root Cause Statement (single sentence: \"Because X, Y happened, leading to Z\")\n\u2713 8) 5 Whys (complete chain)\n\u2713 9) Fault Tree \/ Cause Map (structured list)\n\u2713 10) Counterfactual Analysis (what would have prevented impact)\n\u2713 11) Corrective Actions (next 24h) + Preventive Actions (30\/60\/90 days)\n\u2713 12) Verification Plan (how we know fixes work)\n\nPROMPT STRUCTURE REQUIREMENTS:\n- Context setting (system + constraints)\n- Required Inputs section (list what you need if missing)\n- Output format (the 12 sections)\n- Framework principles (5-7) you will follow\n- Deliverable checklist with \u2713\n\nRULES:\n- Do not blame individuals; focus on system and process\n- Quantify uncertainty and label assumptions\n- Include 3+ plausible hypotheses and show elimination logic\n- Propose metrics\/alerts that would have caught it earlier\n<\/div>\n\n <div class=\"tip-box\"><strong>\ud83d\udca1 Pro Tip:<\/strong> The fastest RCA comes from competing hypotheses. Force yourself to write 3\u20135 plausible causes first, then eliminate them with evidence\u2014this prevents anchoring and \u201cthe first plausible story wins.\u201d<\/div>\n\n <div class=\"section-title-container\"><h2 class=\"section-title\">The Logic<\/h2><\/div>\n\n <h3>1. Timeline Reconstruction Prevents \u201cStory Bias\u201d and Makes Causality Testable<\/h3>\n <p><strong>WHY IT WORKS:<\/strong> Teams often jump to causal explanations before agreeing on what happened. A minute-level timeline aligns everyone on sequence: change events, alerts, traffic shifts, dependency failures, and mitigation steps. Once time ordering is explicit, many hypotheses become falsifiable (\u201ccould not be the cause because it happened after the impact started\u201d). This reduces narrative drift and the tendency to pick the most confident storyteller\u2019s explanation. Timeline discipline also surfaces \u201chidden interventions\u201d (manual restarts, feature flags, backfills) that quietly change system behavior. In complex incidents, timeline errors are common and can waste hours.<\/p>\n <p><strong>EXAMPLE:<\/strong> Suppose checkout failures began at 10:02, but an engineer remembers \u201cwe deployed at 10:15,\u201d so the team blames the deploy. A reconstructed timeline shows a database connection pool saturation spike at 10:01, triggered by a traffic burst from an email campaign at 09:59. The deploy at 10:15 was actually mitigation, not cause. In postmortems, teams who build a timeline first typically reduce false attribution and produce higher-quality corrective actions (monitoring and scaling) instead of superficial fixes (\u201crollback\u201d) that don\u2019t address the real trigger.<\/p>\n\n <h3>2. Competing Hypotheses Reduce Anchoring and Increase RCA Accuracy<\/h3>\n <p><strong>WHY IT WORKS:<\/strong> Human cognition anchors on the first plausible explanation, then selectively searches for confirming evidence. Requiring 3\u20135 competing hypotheses forces disconfirmation: you must ask \u201cwhat evidence would prove this wrong?\u201d This mirrors scientific reasoning and significantly improves RCA accuracy for ambiguous failures. It also prevents blame-driven hypotheses (\u201cperson X changed something\u201d) and shifts toward system mechanisms. In reliability engineering, hypothesis-driven debugging reduces time-to-resolution and post-incident recurrence because fixes align with true mechanisms.<\/p>\n <p><strong>EXAMPLE:<\/strong> Incident: API latency doubled. Hypothesis A: bad deploy. Hypothesis B: dependency timeout (payment provider). Hypothesis C: database index regression. Hypothesis D: network packet loss. You then map each to observable evidence: deploy diff timestamps, dependency error codes, DB query plans, packet loss metrics. If payment timeouts began before any deploy and coincide with provider 5xx errors, Hypothesis B becomes primary. This avoids deploying \u201cfixes\u201d that do nothing. Teams that institutionalize hypothesis lists often see fewer repeat incidents because they test multiple failure channels rather than \u201cfix the obvious.\u201d<\/p>\n\n <h3>3. Fault Trees Expose Multi-Factor Failures Where No Single Cause Explains the Incident<\/h3>\n <p><strong>WHY IT WORKS:<\/strong> Many incidents are not single-point failures; they are cascades: a traffic spike + missing rate limits + slow DB queries + insufficient autoscaling. A fault tree or cause map makes AND\/OR relationships explicit, revealing that removing any one contributing factor might have prevented impact. This helps prioritize fixes: you can choose the cheapest \u201cbreak the chain\u201d action even if it\u2019s not the deepest root cause. Fault trees also reduce political conflict because they show systemic interaction rather than a single scapegoat.<\/p>\n <p><strong>EXAMPLE:<\/strong> Checkout outage: OR node \u201cpayment gateway unreachable\u201d OR \u201cinternal service crashed.\u201d Internal service crash itself is an AND node: \u201cthread pool exhaustion\u201d AND \u201cretry storm\u201d AND \u201cno circuit breaker.\u201d The root isn\u2019t just \u201cpayment gateway slow\u201d; it\u2019s also \u201cwe retried without backoff and had no bulkheads.\u201d CAPA then includes circuit breakers, capped retries, and dependency budgets. Organizations using cause maps tend to improve resilience faster because they address multiple weak links rather than arguing over \u201cthe one true cause.\u201d<\/p>\n\n <h3>4. Counterfactual Analysis Turns Postmortems Into Resilience Design<\/h3>\n <p><strong>WHY IT WORKS:<\/strong> \u201cWhat caused it?\u201d is only half the value; \u201cwhat would have prevented customer impact?\u201d yields actionable resilience investments. Counterfactuals force you to evaluate safeguards: could alerts have fired earlier? Could rate limiting have reduced blast radius? Could feature flags have enabled graceful degradation? This shifts output from explanation to prevention. Importantly, counterfactuals also expose when root cause removal is not enough\u2014e.g., even if you fix the bug, another bug could still cause outage unless safeguards exist.<\/p>\n <p><strong>EXAMPLE:<\/strong> If a cache stampede caused DB overload, the counterfactual might be \u201crequest coalescing\u201d or \u201cstale-while-revalidate\u201d caching. If a bad deploy caused errors, the counterfactual might be \u201ccanary + automated rollback.\u201d If a dependency failed, counterfactual could be \u201ccircuit breaker + fallback response.\u201d Teams that include counterfactuals often reduce recurrence because they add layered defenses rather than only patching the specific bug that happened this time.<\/p>\n\n <h3>5. CAPA with Ownership and Deadlines Prevents \u201cPostmortem Theater\u201d<\/h3>\n <p><strong>WHY IT WORKS:<\/strong> Postmortems often end with vague actions (\u201cimprove monitoring\u201d) that never ship. CAPA (Corrective and Preventive Actions) becomes effective when actions are concrete, prioritized, assigned, and time-bound (24h, 30\/60\/90 days). Splitting corrective vs preventive ensures immediate stabilization plus long-term systemic improvement. Adding verification plans (\u201chow will we know it\u2019s fixed?\u201d) prevents checkbox work. Operational excellence programs show that action specificity and accountability are the strongest predictors of reduced repeat incidents.<\/p>\n <p><strong>EXAMPLE:<\/strong> Instead of \u201cadd alerts,\u201d specify: \u201cCreate alert: checkout 5xx rate > 1% for 5 minutes (SEV-2), route to on-call; add dependency latency alert for payment provider p95 > 800ms; add saturation alert for DB connections > 85% for 10 minutes.\u201d Assign owners and due dates. For prevention: \u201cImplement circuit breaker for payment provider with exponential backoff; canary deploy with auto-rollback; run quarterly load test.\u201d Teams that do this typically see fewer \u201cwe already discussed this last time\u201d frustrations and measurable stability improvements.<\/p>\n\n <h3>6. Verification Plans Close the Loop and Prevent Recurrence<\/h3>\n <p><strong>WHY IT WORKS:<\/strong> Fixes can be incorrect or incomplete. Verification ensures you validate changes with tests, monitoring, and experiments. The verification plan defines: how to reproduce the failure, what metrics should change, what alarms should fire, and what success looks like. This is essential for confidence in high-stakes systems. Without verification, you risk \u201cfixing the wrong thing\u201d and learning only after the next incident.<\/p>\n <p><strong>EXAMPLE:<\/strong> If the incident involved DB connection exhaustion, verification might include: load test that simulates peak traffic; verify connection pool remains < 80%; verify p95 latency stays under target; verify circuit breaker trips properly when provider slows; verify auto-scaling triggers before saturation. In software reliability, teams that verify CAPA reduce repeat incidents substantially because they validate resilience rather than assuming it.<\/p>\n\n <div class=\"section-title-container\"><h2 class=\"section-title\">Example Output Preview<\/h2><\/div>\n <div class=\"example-output\">\n <h4>Sample: RCA for \u201cCheckout Failures Spike\u201d (Realistic Metrics)<\/h4>\n <p><strong>Impact:<\/strong> 4.8% checkout requests failed (HTTP 502\/504) for 118 minutes (10:02\u201312:00). Estimated 2,960 failed checkouts; projected lost revenue $142,000 (avg order $48). SLA breach: availability 99.71% for the day (target 99.9%).<\/p>\n <p><strong>Primary Failure Mode:<\/strong> Payment-service thread pool exhaustion due to retry storm against slow payment gateway; retries amplified load 3.2\u00d7. DB connection pool hit 100% at 10:07, causing cascading timeouts across checkout pipeline.<\/p>\n <p><strong>Contributing Factors:<\/strong> (1) No circuit breaker on payment gateway, (2) Retry policy lacked jitter\/backoff, (3) Autoscaling triggered on CPU only (missed saturation), (4) No alert on dependency latency, (5) Email campaign caused traffic +22% without capacity review.<\/p>\n <p><strong>Counterfactual:<\/strong> Circuit breaker + capped retries would have reduced error rate to <0.5% and limited impact to <10 minutes; saturation alert on DB connections >85% would have detected 14 minutes earlier.<\/p>\n <p><strong>CAPA (Next 24h):<\/strong> Add capped retries (max 1), increase pool sizes safely, add alerts on dependency p95 > 800ms. <strong>30\/60\/90:<\/strong> circuit breakers, bulkheads, canary deploys, quarterly load tests.<\/p>\n <\/div>\n\n <div class=\"section-title-container\"><h2 class=\"section-title\">Prompt Chain Strategy<\/h2><\/div>\n <div class=\"chain-step\"><h4>Step 1: RCA Draft + Hypotheses<\/h4><p><strong>Prompt:<\/strong> Use the main RCA prompt with timeline and evidence.<\/p><p><strong>Expected Output:<\/strong> Full RCA report (5,000\u20137,000 words) with hypotheses, elimination logic, and CAPA.<\/p><\/div>\n <div class=\"chain-step\"><h4>Step 2: CAPA Implementation Plan<\/h4><p><strong>Prompt:<\/strong> \u201cTurn the CAPA list into Jira-ready tasks: owner roles, estimates, dependencies, success criteria, and rollout plan.\u201d<\/p><p><strong>Expected Output:<\/strong> Execution plan that teams can implement immediately.<\/p><\/div>\n <div class=\"chain-step\"><h4>Step 3: Prevention via GameDay<\/h4><p><strong>Prompt:<\/strong> \u201cDesign a GameDay exercise to simulate recurrence. Include failure injection steps, expected alarms, and pass\/fail.\u201d<\/p><p><strong>Expected Output:<\/strong> A resilience drill that validates prevention mechanisms.<\/p><\/div>\n\n <div class=\"section-title-container\"><h2 class=\"section-title\">Human-in-the-Loop Refinements<\/h2><\/div>\n <h3>Require Evidence Tags for Every Claim<\/h3>\n <p>Force every causal statement to cite evidence (log line, metric, trace). <strong>Technique:<\/strong> tag claims as EVIDENCE \/ INFERENCE \/ ASSUMPTION. This reduces speculation and speeds consensus.<\/p>\n <h3>Run a \u201cDisconfirming Evidence\u201d Round<\/h3>\n <p>Ask each participant to present one piece of evidence that contradicts the leading hypothesis. <strong>Technique:<\/strong> 10-minute round-robin before finalizing root cause.<\/p>\n <h3>Separate \u201cTrigger\u201d From \u201cRoot Cause\u201d<\/h3>\n <p>Triggers (traffic spike) are not the same as root causes (no rate limiting). <strong>Technique:<\/strong> document both so fixes address prevention, not just avoiding triggers.<\/p>\n <h3>Quantify Uncertainty Explicitly<\/h3>\n <p>When logs are missing, state confidence levels and what data would raise confidence. <strong>Technique:<\/strong> add a \u201cmissing evidence\u201d section and a data collection action.<\/p>\n <h3>Assign CAPA Owners Before the Postmortem Ends<\/h3>\n <p>Convert learnings into action. <strong>Technique:<\/strong> every CAPA item must have an owner role + due date + verification metric.<\/p>\n <h3>Review Repeat Incidents Quarterly<\/h3>\n <p>Track recurrence themes (timeouts, retries, bad deploys). <strong>Technique:<\/strong> quarterly reliability review that aggregates RCAs into systemic roadmaps.<\/p>\n\n <div class=\"footer\">\n <div class=\"footer-stat\"><div class=\"footer-stat-value\">4.9\u2605<\/div><div class=\"footer-stat-label\">Average Rating<\/div><\/div>\n <div class=\"footer-stat\"><div class=\"footer-stat-value\">2,118<\/div><div class=\"footer-stat-label\">Times Copied<\/div><\/div>\n <div class=\"footer-stat\"><div class=\"footer-stat-value\">169<\/div><div class=\"footer-stat-label\">Reviews<\/div><\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n\n <script>\n function copyPrompt(){\n const promptContent=document.getElementById('promptContent').innerText;\n navigator.clipboard.writeText(promptContent).then(()=>{\n const button=document.querySelector('.copy-button');\n const originalText=button.innerHTML;\n button.innerHTML='\u2713 Copied!';\n setTimeout(()=>{button.innerHTML=originalText;},2000);\n }).catch(err=>console.error('Failed to copy text: ',err));\n }\n <\/script>\n<\/body>\n<\/html>\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>Root Cause Analysis AI – AiPro Institute\u2122 Root Cause Analysis AI Root Cause Analysis AI Problem Solving & Analysis \u23f1\ufe0f 25-40 minutes \ud83d\udcca Advanced ChatGPT Claude Gemini Perplexity Grok The Prompt \ud83d\udccb Copy Prompt You are a senior incident investigator and root cause analysis (RCA) facilitator. Perform a rigorous RCA for the incident\/problem below. [PROBLEM_STATEMENT]…<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[173],"tags":[],"class_list":["post-5674","post","type-post","status-publish","format-standard","hentry","category-problem-solving-analysis"],"acf":[],"_links":{"self":[{"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/posts\/5674","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/comments?post=5674"}],"version-history":[{"count":4,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/posts\/5674\/revisions"}],"predecessor-version":[{"id":5678,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/posts\/5674\/revisions\/5678"}],"wp:attachment":[{"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/media?parent=5674"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/categories?post=5674"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/teen.aiproinstitute.com\/zh\/wp-json\/wp\/v2\/tags?post=5674"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}