部件之间：为什么每个零件都合格，整体仍会失败
Division of labour hands responsibility to the parts and abandons its assumptions in the gaps. What decides whether the whole holds is the channel nobody measures
1. Sound Parts, a Failing Whole
A scene recurs often enough to be familiar and rarely enough to go unexamined. Every component passes inspection, the specification has no gaps, the test reports are complete — and once assembled the system is unstable. The post-mortem almost always produces the same sentence: both sides did their own part correctly, but the two did not meet. The failure occurs inside no component. It occurs between them, belongs to no acceptance report, and therefore did not exist in any of the checks that preceded it.
The first response is usually that the rules were not detailed enough. More documents, another review, one more interface checklist follow. The response is reasonable and frequently useless, because it treats the trouble as a shortage of information: given a sufficiently complete description, the gap would close. What actually sits in the gap is not information that someone forgot to write down. It is a set of assumptions nobody made as a decision — who goes first, who yields when something goes wrong, whose units and whose tolerances apply, who owns the state after a failure. They never need to be spoken precisely because both sides were following their own version of common sense.
The question can therefore be put more sharply: why does a method that verifies every locality systematically fail to see the whole?
2. Local Correctness Is Not Global Correctness
Herbert Simon offers a useful starting point in The Sciences of the Artificial. Hierarchical systems are intelligible and buildable because they are nearly decomposable: interactions within a component are far more frequent and stronger than interactions between components. That is why, over short horizons, each part can be designed and tested as if it were almost independent, while long-run behaviour passes between parts through a small number of aggregate variables. Near decomposability is not a defect. It is the precondition for division of labour. Without it, any local change would immediately disturb everything, and modularity, parallel work and staged acceptance would all be impossible.
The same precondition plants the blind spot. Because coupling across the joints is sparse, it barely appears when a part is verified on its own; it becomes visible only after assembly and only after the system has run for a while. "Every part passes" is thus not an approximation to "the whole passes". It is a claim at a different level: it says that along the cuts where the system was divided, each segment holds on its own terms. Where the cuts are made determines what inspection can see.
This explains a persistent confusion between the coverage of verification and the scope of verification. Coverage can be driven very high while every object covered is a component. The sparse channel that governs the behaviour of the whole belongs to no component and therefore falls outside coverage by construction.
3. Who Owns the Assumptions in the Gap
Fred Brooks approaches the same structure from another direction in The Mythical Man-Month. He insists that large systems require conceptual integrity: design should be held coherently by a small number of people, and it is better to ship fewer features than to let a system's design philosophy split into several internally rational but mutually incompatible local ones. He also gives the familiar arithmetic — if every pair must communicate, coordination grows as n(n−1)/2, and adding people to a late project makes it later. What is usually missed is the causal link between the two claims. Once division of labour cuts a system into pieces, coordination does not disappear; it changes from doing design to aligning designs, and nobody naturally owns the second activity.
Don Norman places a similar mismatch between person and artefact in The Design of Everyday Things. His gulf of execution and gulf of evaluation name two breaks in use: whether an intention can be turned into an available action, and whether the result can afterwards be read back from the thing. Both gulfs lie at the interface, not inside the user and not inside the object. Translated into an organisation, the seam between two components is exactly such an interface: an action emitted on one side, a feedback read on the other, and a translation channel in between that nobody was assigned to maintain.
The direction of measurement matters more still. Responsibility is divided by component, metrics are collected by component, sign-off is granted by component, so every record is generated inside a component. A failure at the seam can be neither recorded nor attributed, and what cannot be attributed will be reproduced unchanged next time. This is not individual carelessness. It is a way of drawing "who answers" and "where the system breaks" on two different maps.
4. Tolerance Budgets and the Unmeasured Channel
Engineering practice supplies a plainer corroboration. Structures: Or Why Things Don't Fall Down devotes so much attention to connections and joints because loads can only travel across seams; however accurately a beam is calculated, it is the turning, concentration and eccentricity of forces at the joint that make the weak point. Simon Winchester's The Perfectionists treats tolerance as a central concept in the history of manufacturing, and tolerance is defined precisely as how much mismatch is permitted: it does not demand that parts be identical, it specifies how much divergence between parts is acceptable. Industry has long admitted, in other words, that what requires explicit management is never the part but the relation between parts.
Donella Meadows gives the more general reason in Thinking in Systems: behaviour is largely shaped by the structure of information flows — who holds which information, where it is cut off or delayed — often more than by the performance of any single element. Read alongside the earlier sections, the conclusion is not an exhortation to communicate better but a testable diagnosis. If a system keeps failing at its joints, then information about the joints has never entered anyone's decision loop.
That also explains why writing more documents so often fails. A document states a component's outward declaration, whereas the failure comes from the unspoken premises on each side of that declaration. As long as measurement and accountability point only at components, additional text is simply one more component-level artefact.
5. Objections and Limits
The strongest objection comes first. Attributing failure to the seam easily becomes a way of blaming "communication" and letting a genuinely defective part off the hook. Such cases are common: one side really did miscalculate, the material was below spec, the implementation departed from the design, and an ambiguous interface merely gave the error somewhere to hide. Overusing the seam frame manufactures a polite evasion — if nobody is wrong, nobody has to change anything. Component-level explanations must be exhausted before this diagnosis is used, not skipped in its favour.
A second objection comes from another design tradition. Assigning an owner to every seam and turning every assumption into a contract produces an interface bureaucracy: coordination becomes a permanent layer, its cost is locked in, response slows. The end-to-end argument runs the other way — keep intelligence at the edges, keep the middle simple, and let users absorb much of the ambiguity, which is often cheaper and more robust. Part of the adaptability of loosely coupled systems comes precisely from seams that were never written down. Demanding that everything be explicit assumes an environment stable enough to be worth contracting over in full.
A third point bounds the scope. Near decomposability is conditional. For ecosystems, macroeconomic systems or organisational culture, "components" are fictions cut out by the analyst rather than boundaries present in the world; hunting for a seam there turns continuous mutual influence into a fictitious handover accident. The judgement below holds only for systems with genuinely clear layering, whose parts can be independently verified.
It should also be admitted that making seams observable has a cost of its own. Cross-boundary logging, contracts and joint acceptance consume resources that could have improved the parts, and in a small system they are often a net loss. The return grows with scale and with the number of cooperating parties. It is not unconditional.
6. Judgement: Make the Seam Observable, Not Rigid
The actionable conclusion is therefore not to freeze the interfaces but to bring the unmeasured channel inside measurement. Three concrete tests follow. First, the assumptions shared across components must be written as explicit agreements whose ownership does not sit with either party alone. Second, cross-boundary failures must be counted separately rather than folded into the same defect list as faults inside a component — otherwise they will always be assigned to one side. Third, acceptance of the seam must carry the same weight as acceptance of the parts, meaning there exists a check that can only be passed in combination, rather than resting all confidence on separate sign-offs.
Together these point to a more general conclusion: the ceiling on a system's reliability is set by its least-measured relation, not by its weakest component. A weak part can be replaced. An unmeasured relation leaves even the question "where is it weak?" unaskable. Extending verification from objects to the assumptions between objects is not one more procedure. It supplies an observation post that did not previously exist.
The judgement still needs its own boundary. Observable is not the same as removable. Writing an assumption down admits it to discussion; it does not guarantee that anyone will pay the price of changing it. Many chronic interface failures are rooted not in knowledge but in the fact that a change would disturb the settled arrangements of both parties. Visibility is still worth having: at minimum it turns a technical dispute back into a negotiable question about division of labour, instead of letting it reappear at the next post-mortem in the familiar costume of "both sides did it right".
