---
title: Four-Tier Root-Cause Framework
url: https://www.emergentmind.com/topics/four-tier-root-cause-framework
type: topic
---

# Four-Tier Root-Cause Framework

Searching arXiv for the cited papers to ground the article in current literature.
arXiv search query: 2406.19711 CHASE root cause analysis microservice causal heterogeneous graph
arXiv search query: 2305.10638 CORAL online unsupervised root cause analysis
arXiv search query: 2601.02736 SpecRCA hypothesize then verify microservices root cause analysis
arXiv search query: 2507.20175 four-tier root cause framework smart contract exploit chains
arXiv search query: 2606.20758 four-tier operational memory root cause derivation explanation OpsCortex
arXiv search query: 2509.02535 probabilities of causation quasi-Markovian root cause analysis path ranking
The expression **Four-Tier Root-Cause Framework** denotes a family of four-level decompositions for root-cause analysis rather than a single canonical formalism. In recent arXiv literature, the four-tier form is used to partition RCA into analytically distinct layers for online triggering and causal-graph updating, multimodal hypothesis drafting and verification, operational memory, exploit-root-cause taxonomy, and probabilities-of-causation ranking. The common rationale is to separate distinct burdens—observation, structure, causal inference, and diagnosis or explanation—so that RCA remains tractable under complex dependencies, multimodal evidence, latent confounding, or evolving system state [2305.10638][2601.02736][2606.20758][2507.20175][2509.02535].

## 1. Conceptual scope and major variants

The literature uses four-tier organization in several non-equivalent ways. Some frameworks are **procedural**, arranging RCA as a sequence of stages. Others are **architectural**, arranging persistent operational knowledge by lifetime and purpose. Others are **taxonomic**, arranging the root causes themselves from high-level design down to implementation defects. A further line of work supports a four-level reading of RCA as node-, edge-, path-, and system-level causal attribution [2305.10638][2601.02736][2606.20758][2507.20175][2509.02535].

| Variant | Four tiers | Primary object |
|---|---|---|
| CORAL | Trigger Point Detection; Structural Causal Knowledge; State-Specific Causal Reasoning; Root Cause Ranking, Convergence, and Online Update Control | Online RCA pipeline |
| SpecRCA | Telemetry and context acquisition; Suspiciousness scoring and hypothesis drafting; Hypothesis verification with pathwise parallelism; Synthesis, ranking, and explanation | Hypothesize-then-verify microservice RCA |
| OpsCortex | Hot Working Memory; Live Dependency Graph; Snapshot History; Permanent Brain | Operational-memory architecture |
| Smart-contract SoK | Protocol logic design; Lifecycle and governance; External dependencies; Traditional implementation bugs | Exploit-root-cause taxonomy |
| Quasi-Markovian RCA | Local variable-level attribution; Edge/mechanism-level attribution; Path/narrative-level attribution; Systemic/structural attribution | Causal-attribution stack |

This diversity is central to the term’s meaning. A four-tier root-cause framework is therefore best understood as a structured decomposition principle whose exact semantics depend on the domain and on what is being tiered: computation, memory, explanation, or causal depth.

## 2. Workflow-oriented four-tier frameworks in systems RCA

In workflow-oriented uses, the four tiers form an end-to-end RCA process. CORAL, an online unsupervised RCA framework for streaming multivariate time series, is explicitly organized as **Trigger Point Detection**, **Incremental Disentangled Causal Graph Learning**, **Network Propagation-based Root Cause Localization**, and **Convergence-based Online Loop Control**. Triggering is based on MSSA combined with CUSUM, with the change time estimated as
$$
\hat{\tau} = \inf_{t > T_0} \{ t \mid y(t) \ge h \}.
$$
After a trigger, batches from the new state incrementally update a DAG through state-invariant and state-dependent components, and a random walk with restarts is applied to the updated causal graph. The online RCA process terminates when the causal graph and the generated root cause list converge; in an AIOps case study, CORAL finds the correct root cause **nine batches earlier** [2305.10638].

SpecRCA instantiates a different procedural four-tiering for microservices. Its pipeline comprises telemetry and context acquisition, suspiciousness scoring and hypothesis drafting, hypothesis verification with pathwise parallelism, and diagnosis synthesis. The drafting stage fuses metrics, traces, logs, and service topology into a ranked hypothesis set, while the verifier evaluates each candidate through self, upstream, and downstream reasoning in parallel. On the AIOps 2022 dataset, the reported preliminary results are **Recall@1 61.34**, **Recall@3 75.72**, **Recall@5 81.63**, **MRR 62.64**, and **Speed 9.89 s/query**, compared with **52.79 s/query** for RCAgent and **83.17 s/query** for mABC [2601.02736].

Adjacent microservice work shows how graph-centric components populate the middle tiers of such pipelines. "CHASE: A Causal Hypergraph based Framework for Root Cause Analysis in Multimodal Microservice Systems" encodes traces, logs, and system monitoring metrics into embeddings, models them by a multimodal invocation graph, performs anomaly detection on each instance node with attentive heterogeneous message passing from adjacent metric and log nodes, and then learns from a hypergraph whose hyperedges represent the flow of causality. This suggests how multimodal representation learning and causal-flow localization can serve as Tier-2 and Tier-3 mechanisms in workflow-oriented designs [2406.19711].

Across these systems papers, the four-tier structure is used to separate **when RCA is triggered**, **how system structure is represented**, **how causal influence is propagated**, and **how a diagnosis is finalized**.

## 3. Memory-centric four-tier architectures and the separation of derivation from explanation

A distinct interpretation appears in OpsCortex, where the four tiers are not stages of a pipeline but layers of operational memory. The system is organized as **Tier 1: Hot Working Memory (Redis)**, **Tier 2: Live Dependency Graph (NetworkX)**, **Tier 3: Snapshot History (Neo4j)**, and **Tier 4: Permanent Brain (SQLite)**. Tier 1 stores current metric values, per-metric sliding windows, and an alert stream, with a TTL of roughly **~2 hours**. Tier 2 maintains a three-level directed graph of services, categories, and metrics, updated every **~5 s**. Tier 3 serializes the full Tier 2 graph every **60 seconds**. Tier 4 persists baselines, confirmed call edges with confidence counts, a registry of structural noise, and incident history [2606.20758].

OpsCortex couples this memory hierarchy to a two-stage RCA design that explicitly separates **root-cause derivation** from **root-cause explanation**. Derivation is deterministic and is computed from a learned dependency graph and the temporal ordering of threshold crossings:
$$
\text{root} = \arg\min_{s \in \mathcal{R}(f)} t_{\text{amber}(s)}.
$$
The LLM is then used only to **explain, confirm, and recommend**, using evidence that the system has already assembled. The architecture thereby treats operational memory as the substrate of RCA and constrains generative modeling to post hoc narrative and remediation. The prototype is validated on an instrumented e-commerce benchmark with **eight injectable failure scenarios**, while also noting that no formal quantitative metrics or comparison against MicroRCA or LLM-only systems are reported [2606.20758].

This formulation changes the meaning of “tier.” The tiers are no longer successive computations but persistent representational strata with different lifetimes: the present, current connectivity, temporal history, and durable knowledge. A plausible implication is that four-tier RCA can function not only as a diagnostic workflow but also as a memory discipline for preserving the context that conventional monitoring stacks discard.

## 4. Causal formalization, probabilities of causation, and multi-level attribution

A more formal use of four-level organization arises from the paper on quasi-Markovian models, which introduces algorithmic simplifications for computing **Probability of Necessity (PN)**, **Probability of Sufficiency (PS)**, and **Probability of Necessity and Sufficiency (PNS)** under latent confounding. In the root-cause use cases, variables are binary, with
$$
\mathrm{PN} = \Pr(Y_{X=0}=0 \mid X=1, Y=1), \qquad
\mathrm{PNS} = \Pr(Y_{X=1}=1, Y_{X=0}=0).
$$
The paper also introduces weaker interventional proxies, **w-PN** and **w-PS**, and works under quasi-Markovian assumptions: each endogenous variable has at most one exogenous parent, endogenous variables have finite support, exogenous variables are independent, and the graph is acyclic [2509.02535].

The computational contribution is to reduce the complexity of bounding these probabilities through counterfactual graphs and reduction theorems. Instead of using a full twin network, the method removes irrelevant ancestors and fixes identifiable marginals, so that the optimization degree is tied to the number of exogenous variables in the reduced graph. In one example, after reductions only two exogenous variables remain, and Gurobi computes
$$
\mathrm{PN} \in [0.175, 0.245], \qquad
\mathrm{PNS} \in [0.35, 0.49]
$$
in less than **10 ms** [2509.02535].

The same paper supports a four-tier reading of RCA as a hierarchy of attribution: **local variable-level attribution**, **edge/mechanism-level attribution**, **path/narrative-level attribution**, and **systemic/structural attribution**. At the path level, candidate explanations are ranked by a significance score
$$
S(\pi) = w \cdot \mathrm{PC}(X_r, Y) + \sum_{X_j \in P\setminus\{Y, X_r\}} \mathrm{PC}(X_j, Y),
$$
where \(X_r\) is the path head and \(\mathrm{PC}\) is instantiated by PN, PS, PNS, w-PN, or w-PS. In the reported synthetic microservice-like experiments, **PN identifies the correct root cause in all but one scenario**, **PS often fails**, **PNS is intermediate**, and **w-PN is significantly better than w-PS** [2509.02535].

This line of work makes explicit that a four-tier root-cause framework can be a graded causal semantics: first score candidate variables, then inspect mechanisms, then rank full causal narratives, and finally analyze how structural ambiguity and latent confounding shape the diagnosis.

## 5. Four-tier taxonomies of root causes beyond software operations

In the smart-contract security literature, the four-tier form is used not for diagnostic workflow but for categorizing the causes of large-scale incidents. The SoK on Ethereum exploits defines the tiers as **(1) protocol logic design, (2) lifecycle and governance, (3) external dependencies, and (4) traditional implementation bugs**. It distinguishes the **root cause** from a **surface-level vulnerability**, and introduces **exploit chains** to capture attacks that require multiple linked weaknesses rather than a single bug. The paper analyzes **71 academic papers** to produce a catalog of **24 active** and **5 deprecated** vulnerabilities, and then studies **50** severe real-world exploits between 2022 and 2025, collectively causing **\$1,093,979,779** in losses [2507.20175].

The principal finding is that successful attacks are usually not reducible to Tier-4 coding errors alone. The distribution over the 50 incidents is reported as **T1: 24%**, **T2: 24%**, **T3: 24%**, and **T4: 28%**, with **only ~28% of losses rooted purely in Tier-4 bugs**. Tier 1 covers flawed economic design and protocol logic; Tier 2 covers deployment, upgrade, configuration, and governance failures; Tier 3 covers unsafe assumptions about oracles, bridges, other protocols, or unvalidated external inputs; Tier 4 covers classic implementation-level weaknesses such as reentrancy, rounding errors, access control flaws, and dangerous delegatecall patterns [2507.20175].

The case study on **“clumsy deployments & upgrades”** further shows how the taxonomy becomes operational. Nomad Bridge, Ronin Bridge, Yearn Finance, and Unizen are grouped under a Tier-2 subcategory, with combined losses of **\$215.5M**. The proposed defenses include invariant-checked upgrades, staged roll-outs, operational gates, and runtime monitors or circuit breakers [2507.20175].

This taxonomy materially broadens the meaning of RCA. Instead of asking only which code path failed, it asks whether the earliest enabling condition lay in protocol economics, governance process, dependency assumptions, or implementation. A plausible implication is that four-tier RCA can serve as a cross-layer audit lens rather than only an online diagnosis mechanism.

## 6. Common design patterns, misconceptions, and limitations

The papers do not converge on a single canonical four-tier partition. Instead, the same four-tier form is reused for different analytical objects: **workflow stages** in CORAL and SpecRCA, **memory strata** in OpsCortex, **exploit-cause layers** in the smart-contract SoK, and **causal-attribution levels** in the quasi-Markovian framework [2305.10638][2601.02736][2606.20758][2507.20175][2509.02535]. A common misconception is therefore that a four-tier root-cause framework must be a chronological incident-response pipeline. In the literature, it may equally be a storage architecture or a taxonomy of causal depth.

A second recurring pattern is the deliberate restriction of high-variance reasoning components. CORAL uses MSSA, SVAR, VGAE, and RWR, but closes the loop only when graph and ranking similarity stabilize. OpsCortex computes the root cause deterministically from topology and alert timing, and asks the LLM only to explain, confirm, and recommend. SpecRCA uses a non-LLM drafting module and a small LLM verifier, reserving synthesis to a later stage. This suggests a broader design principle: the four-tier form is often used to separate low-variance structural inference from higher-variance interpretive reasoning [2305.10638][2601.02736][2606.20758].

The same literature also emphasizes nontrivial assumptions and limitations. CORAL assumes causal sufficiency, piecewise-stationarity, sparsity, and a DAG. OpsCortex states that “who crossed threshold first” is an imperfect proxy for causation and reports no formal comparative metrics. The quasi-Markovian framework depends on acyclicity, finite-valued variables, independent exogenous variables, and a correct causal graph. The smart-contract SoK shows that audits restricted to Tier-4 implementation bugs leave most real-world loss unexplained. Accordingly, the significance of the four-tier root-cause framework lies not in a fixed universal taxonomy, but in a disciplined way of separating distinct explanatory burdens so that RCA can remain interpretable under multimodality, graph structure, temporal evolution, or layered causal depth [2606.20758][2509.02535][2507.20175].

Source: https://www.emergentmind.com/topics/four-tier-root-cause-framework