What is the 5 Whys method in maintenance?
The 5 Whys is a structured cause-questioning technique that repeatedly asks why an observed equipment failure or defect occurred. Maintenance teams use it to move from the immediate symptom toward physical and systemic contributors, checking each causal link with records, inspection, measurements, or witness evidence. The number of questions is not fixed; complex, high-consequence, or multi-cause events require broader RCA methods.
Use 5 Whys for bounded problems, not as a substitute for a major-incident investigation.
A narrow, well-observed event with a plausible chain of causation is often a good fit: a repeated bearing contamination incident, a recurring pneumatic leak, or a work-order closeout defect. Start with one clear event, the asset and failure mode, the date and operating context, and the observable impact.
Escalate to a facilitated RCA when there is significant safety or environmental potential, major production or quality loss, complex interactions, conflicting evidence, repeated ineffective fixes, or more than one credible causal chain. Do not force a five-line answer to a system failure.
Define the event, build a causal chain, and challenge every link.
'Operator error' and 'technician failed to inspect' are not verified physical explanations. Ask how the design, standard, tooling, information, training, environment, and supervision made the outcome possible.
- Write the problem as a verifiable event: what failed, where, when, and what observable functional loss occurred.
- Ask why that event happened; write an answer that can be tested, not a person or department to blame.
- For each answer, record supporting evidence, conflicting evidence, and what would disprove the hypothesis.
- Ask why again while the chain remains credible. Branch when two independent contributors are necessary.
- Stop when the remaining controllable conditions are understood sufficiently to choose actions, or escalate when evidence is incomplete.
- Assign corrective action, owner, due date, implementation proof, and an effectiveness review after sufficient operating exposure.
Worked example: a pump trips after a bearing overheats.
This is one candidate chain, not a diagnosis. If inspection instead shows water ingress and intact lubricant delivery, the chain must change. Other contributors such as seal design, storage, contamination, load, or alignment should not disappear because a neat narrative was written.
| Question | Candidate answer | Verification required |
|---|---|---|
| Problem | Pump lost duty after a high-bearing-temperature trip. | Alarm history, operational record, and physical inspection. |
| Why 1? | The bearing generated excess friction. | Bearing damage pattern, temperature trend, lubricant analysis. |
| Why 2? | Lubrication was inadequate at the rolling contact. | Lubricant condition, delivery path inspection, installation evidence. |
| Why 3? | The lubrication port did not deliver the intended quantity. | Flow or access check under approved conditions. |
| Why 4? | The port was obstructed after recent work. | As-found evidence, work history, photos, part condition. |
| Why 5? | The assembly/verification standard did not detect that obstruction. | Approved work instruction, inspection sign-off, test acceptance records. |
Avoid five common failure points in a 5 Whys workshop.
- Beginning with 'bearing failed' when the actual failed function was loss of required pump flow.
- Treating a hypothesis as fact because it sounds technically plausible.
- Assuming one linear chain when multiple necessary contributors exist.
- Ending at human error, a missing PM, or a training recommendation without verifying the systemic condition.
- Closing the investigation when the action is assigned rather than after implementation and adequate effectiveness observation.
The investigation succeeds when it changes the operating system and the trend.
A closure package should include the event statement, evidence for and against key hypotheses, accepted causal chain or remaining uncertainty, corrective-action owner, controlled document or CMMS changes, and measurable effectiveness criteria. In the pump example, corrective measures might include an approved verification step, a design change, or condition-monitoring coverage depending on confirmed evidence.
Use work-order history or FRACAS to confirm whether the same mode has stopped recurring over a meaningful and comparable exposure period. If it repeats, reopen the hypothesis; do not simply increase PM frequency without technical justification.
When should 5 Whys become a full RCA?
Escalate when the event is high consequence, materially uncertain, cross-functional, or recurrent after an implemented fix. The five lines are a thinking aid; they do not replace evidence, safety investigation, causal testing, or technical authorization.
- Use only observed evidence to assert a cause.
- Allow branches and fewer or more than five whys.
- Separate interim containment from permanent corrective action.
- Verify effectiveness after sufficient exposure.
Technical references
- ASQ: Five Whys and Five Hows — Explains repeated why-questioning, including that a useful investigation may require fewer or more than five questions.
- NASA Reliability-Centered Maintenance Guide — Connects failure modes, effects, consequences, and maintenance policy selection.
Turn the investigation into a controlled improvement.
Record the evidence, authorize the right corrective action, and verify whether recurrence changes rather than filing a completed 5 Whys sheet.
RCM learning path See facility-specific XRVE services