Resilience and capacity

One of the conditions the line 3 learning team raised had nothing to do with labels, buttons or scrapers. On night shift, the main plant had one maintenance technician for the bakery's three lines. When Ben was called to the line 3 changeover, he left a half-finished repair on line 1, which was due back in production at 7:00. While he worked on line 3, the line 1 lead radioed twice to ask when he would be back. 'There is no slack on nights,' Ben said. 'If two things go wrong at once, something gets rushed.'

This lesson is about slack, margin and the ability of an operation to cope with the unexpected. It draws on resilience engineering, which studies how systems keep working under changing conditions, and on the HOP idea of capacity: the ability of the work to absorb an error or a surprise without someone getting hurt.

From preventing failure to building capacity

Most safety management is about preventing specific failures: identifying hazards, putting controls in place, checking that people follow procedures. That work remains essential. But no organization can anticipate every combination of conditions, and Lessons 2 to 4 showed that errors and adaptations will always occur. Resilience engineering adds a second question: when something unexpected happens, how well can the operation notice it, absorb it and recover?

HOP practitioners often express this as building capacity. Capacity is the margin between normal work and harm: the defences, time, people, skills and options available when something goes wrong. An operation with high capacity can fail safely. An error is caught, a surprise is absorbed, a failure is contained. An operation with low capacity turns small problems into harm, because there is nothing between the error and the injury.

Conklin and others put it in a way that stuck with the Harrowgate Foods Ltd. leadership team: safety is not only the absence of accidents but the presence of capacity. A month without injuries says little about capacity. A line where a technician can make the predictable mistake and nothing bad happens says a lot.

Four abilities of a resilient operation

Hollnagel described four abilities that together make an operation resilient. They are things an organization does, not things it has, and each can be strengthened deliberately.

Responding

Responding is the ability to deal with what happens, whether expected or not: to stop, adapt, recover and carry on. It depends on people having the authority to stop work, the skills to deal with unusual situations, the resources to act, and procedures for foreseeable emergencies. At Harrowgate Foods Ltd., the stop-work authority described in HSE-401 Lesson 5 was part of responding. So were the emergency stops, rescue plans and first aid capability on each shift.

Monitoring

Monitoring is the ability to see what is happening, including the weak signals that something is changing. It goes beyond the lagging indicators critiqued in HSE-407. Monitoring includes critical control verifications, trap reports, post-job reviews, overtime and fatigue data, maintenance backlogs, and the informal signals supervisors pick up on the floor. The line 1 lead's radio calls on the night of the event were a weak signal that maintenance capacity was stretched.

Learning

Learning is the ability to learn from what has happened, both failures and successes. Lessons 7 and 8 covered learning teams and operational learning. The resilience view adds a warning: an organization that learns only from failures learns from a tiny and unusual sample of its work. Most of what keeps work safe is visible only in everyday success.

Anticipating

Anticipating is the ability to look ahead: to foresee changes, peaks, threats and opportunities, and prepare for them. Seasonal peaks, new products, equipment changes, staff turnover and supply problems can all be anticipated. A pre-mortem, an approach described by psychologist Gary Klein, is one tool: before a change, the team imagines that it has gone badly wrong and asks what caused the failure.

Where capacity comes from

Capacity is built from several sources, and the most resilient operations draw on all of them.

• Strong controls that work even when someone errs, as described in Lessons 5 and 9.
• Time: enough time in the schedule for critical steps to be done properly, and for people to stop and think when something looks wrong.
• People: enough people with the right skills on each shift, so that two problems at once do not force a choice between them.
• Skill depth: cross-training, so that more than one person can do each critical job, and experienced people available to help newer ones.
• Equipment margin: spare parts, backup equipment and maintenance that keeps reliability high, so that breakdowns do not create constant pressure.
• Authority: frontline people able to stop work, change the plan or call for help without waiting for permission.
• Recovery: the ability to return to a safe state quickly, through emergency stops, isolation, rescue and first aid.

Utilization and time pressure

Ben's complaint about slack on nights reflected a well-known feature of busy systems. When a resource such as a technician is busy most of the time, the delay before they can respond to a new call grows very quickly as the busy share approaches 100 %. Nina Castillo, the finance data analyst who had built the metrics models in HSE-407, used a standard queueing formula to show the leadership team why.

# Waiting time for a technician as utilization rises (single-server queue)
repair_minutes = 30        # average time to deal with one call
for utilization in (0.5, 0.7, 0.8, 0.9, 0.95):
    wait = repair_minutes * utilization / (1 - utilization)   # average wait before work starts
    print(f"busy {utilization:.0%} of the time: average wait {wait:5.0f} minutes")

# night shift calls before and after adding a second technician
calls_per_hour = 1.6
one = calls_per_hour * repair_minutes / 60
two = one / 2
print(f"one technician: utilization {one:.0%}")
print(f"two technicians (each): utilization {two:.0%}")

busy 50% of the time: average wait    30 minutes
busy 70% of the time: average wait    70 minutes
busy 80% of the time: average wait   120 minutes
busy 90% of the time: average wait   270 minutes
busy 95% of the time: average wait   570 minutes
one technician: utilization 80%
two technicians (each): utilization 40%

The formula assumes random arrivals and service times, which real work only approximates, but the shape of the result holds. At 50 % utilization, calls waited on average about as long as a repair took. At 80 %, four times as long. At 95 %, nearly ten hours. With one technician covering the night shift at about 80 % utilization, every additional call created waiting, and waiting created radio calls, and radio calls created pressure to rush critical steps. A second technician on nights brought each person's utilization to about 40 %, and average waits fell to a fraction of a repair time.

The decision to add the second technician was debated. It cost about the same as a year of the plant's spending on safety training. Marcus argued for it on reliability grounds as much as safety: night breakdowns were delaying morning starts. Richard Lam, the chief executive, approved it after Margaret Doyle asked the board's committee a simple question: 'What do we think the line 3 event would have cost if the glove had not torn?'

Capacity at the distribution centre

Capacity issues at the Dartmouth distribution centre looked different. The site's workload swung sharply with the seasons, peaking in the six weeks before the December holidays, when volumes ran about 40 % above average. In past years the site had met the peak with agency workers, longer shifts and temporary staging lanes, the same conditions that had led to the aisle 14 forklift strike investigated in HSE-403.

Grace Whitfield and Sam Pellerin ran a pre-mortem in September. The team imagined that it was January, and that someone had been seriously hurt during the peak. What had happened? The answers came quickly: an agency driver unfamiliar with the site, a staging lane created without a walkway, a tired picker stepping out at an aisle end, a trailer pulling away early from a dock under pressure to clear the yard.

From that list, the team built capacity in advance. Agency drivers started three weeks earlier, with practical evaluations completed before the peak rather than during it. Temporary staging lanes were planned and marked in October, with walkways, through management of change. Shifts were capped at ten hours, with a rule that no one worked more than five in a row. Extra dock supervisors covered the busiest hours. And the critical control verifications for forklift separation and trailer restraints were doubled during the peak, with results reviewed daily.

The peak passed with two minor injuries and 31 near-miss reports, most of them early in the peak and most leading to small changes. Grace said the pre-mortem had been the most useful hour she spent all year.

Tensions and trade-offs

Capacity costs money, and an organization under financial pressure tends to remove it. Spare people look like overstaffing, spare time looks like inefficiency, and spare equipment looks like waste. Lean programs, valuable in many ways, can strip out buffers that were quietly protecting safety, as the line 3 changeover history in Lesson 4 showed.

The project did not argue that all slack is good. It argued that slack at critical points should be a deliberate decision, made with an understanding of what it protects. The questions it asked when production or staffing changes were proposed were: what margin does this remove, at which critical steps, and what will we put in its place? A change that removed margin at a critical step needed either a stronger control or a decision, at the right level, to accept the risk.

Monitoring capacity

If capacity matters, it should be monitored. Harrowgate Foods Ltd. added a small set of capacity indicators to the reports described in HSE-407: overtime hours per worker by site and shift; the share of shifts over twelve hours; maintenance backlog for safety-critical equipment; the number of critical roles with only one trained person; and the time from a call for a technician to the technician arriving, by shift. None of these was a safety outcome. Each was a signal of how much margin remained between normal work and harm.

Practising the response

Responding well to an emergency depends on skills that are rarely used, and skills that are rarely used fade. Harrowgate Foods Ltd. had always run fire evacuation drills. The project added short, realistic exercises for the events most likely to cause serious harm: an ammonia release in the engine room at the Truro plant, a person trapped in a mixer bowl at Kentville, and a worker caught in a conveyor. Each exercise was planned with the crews, run on a normal shift with minimal warning, and followed by a post-job review asking what went as planned, what surprised people and what should change.

The first conveyor rescue exercise on line 3 was humbling. The crew took four minutes to find the right disconnect for the section where the casualty was, because the emergency isolation chart was in the maintenance office, and nobody on the shift had used the reverse jog function needed to free a trapped arm. Within a month, emergency isolation charts were posted at every line, and every technician had practised the reverse jog under supervision. The second exercise, six months later, took under a minute to isolate. Exercises of this kind strengthen the responding ability directly, and their reviews feed the learning and anticipating abilities as well.