Pillar 03 · The Resilient Factory

When the entire supply chain is disrupted

On 11 March 2011, a powerful earthquake struck northeastern Japan, followed by a devastating tsunami. The disaster affected communities, infrastructure and manufacturing operations across the country. For Toyota, the consequences extended far beyond the plants directly affected by the disaster.

Components that appeared to be routine inputs to vehicle production suddenly became difficult to obtain. Suppliers were unable to operate normally, transport and logistics were disrupted, and factories outside Japan began to feel the consequences of shortages thousands of kilometres away.

Toyota's own historical account describes the scale of the challenge. The company identified damage at 659 supplier sites, including suppliers further down the supply chain. As it investigated the situation, it found that hundreds of parts required immediate attention. Purchasing, engineering and production teams worked with suppliers to restore production, find alternatives and prepare substitute components where necessary. Toyota's account of the Great East Japan Earthquake and its production recovery documents these efforts.

The impact was substantial. In April 2011, Toyota expected global production to return to normal only around November or December. North American plants were operating at reduced capacity because of parts shortages, even though the plants themselves had not suffered the same direct physical damage. Production recovered faster than initially expected, and Toyota's North American operations returned to 100% production by September. Toyota's September 2011 production update records that recovery.

This episode illustrates something important about manufacturing. A factory does not operate independently of the network around it. Its ability to produce depends on suppliers, transport, utilities, information, people and other operations working together.

When one of these dependencies fails, the consequences can travel much further than the original event. A plant that has modern machines and an efficient production system may still be unable to produce because a small but essential component is missing.

The question for manufacturing leaders is therefore not just how to prevent failures. It is how to keep the business functioning when some of those failures cannot be prevented, and how to recover without allowing a disruption to spread further than necessary.

That is the challenge of building a resilient factory.

A problem rarely stays where it starts

The same pattern can be seen inside a much smaller manufacturing operation.

Consider a machining plant producing components for several customers. One of its critical machines fails, and the required spare part is not available locally. Maintenance estimates that the repair will take three days.

The immediate problem is clear enough: the machine is unavailable, and the production plan has lost capacity.

The production planner now has to reconsider the orders scheduled for that machine. Some components are already waiting for the affected operation. Others have completed machining and are at an external supplier for heat treatment or surface finishing. A few orders are approaching their delivery dates, and the customers have little flexibility to accept delays.

The team considers moving work to another machine. However, the alternative requires a different fixture, and its programme has not been validated for the component. Meanwhile, parts that were expected back from the external processor have not arrived. The next production sequence depends on those parts.

A machine failure has now become a planning problem, a material problem, a quality-approval problem and a customer-delivery problem.

The factory may eventually recover the lost output. But recovery itself consumes resources. Operators may work overtime, machines may require additional changeovers, planners spend time rearranging orders, and quality teams must ensure that the revised sequence does not introduce new problems.

The original failure may be confined to one machine. Its consequences are not.

This is why resilience cannot be treated as a maintenance responsibility alone. Maintenance must restore equipment, but the wider organisation must understand which orders are affected, which alternatives are available, how priorities should change and what customers need to know.

The same applies when a supplier misses a delivery, a batch fails inspection, an energy interruption affects production or a critical information system becomes unavailable. The event starts somewhere, but the impact depends on the connections around it.

A resilient factory understands those connections before a disruption forces everyone to discover them under pressure.

Efficiency is not the same as resilience

Manufacturers have spent decades improving utilisation, reducing inventory, standardising processes and eliminating waste. These remain essential objectives. An inefficient factory will struggle to compete, and carrying unnecessary inventory or maintaining idle equipment is not a sensible way to prepare for every possible disruption.

But an operating model built entirely around normal conditions can become fragile.

A single-source supplier may offer excellent pricing and consistent quality. A dedicated production line may deliver outstanding efficiency for one product. A highly automated process may reduce labour requirements and cycle time. Each can be a good business decision, yet each can also create a dependency that becomes expensive when conditions change.

The difficulty is not that these decisions are inherently wrong. It is that the economic benefits are often visible every day, while the consequences of a disruption remain hypothetical until something goes wrong.

A manufacturer may know that an alternative supplier would cost more, but not have calculated the cost of being unable to produce for two weeks. A plant may know that a second machine would reduce utilisation on both machines, but not understand how much revenue could be lost if the primary machine failed. A factory may minimise spare-parts inventory without identifying which components have long lead times and no practical substitute.

Resilience requires management to look at both sides of these decisions.

It would be unrealistic to eliminate every dependency. Maintaining duplicate machines, excess inventory and alternative suppliers for everything would make many manufacturing businesses uncompetitive. The objective is to identify the dependencies that could threaten the operation and decide what level of protection is justified.

For one manufacturer, the right decision may be to qualify a second supplier for a critical component. For another, it may be to validate an alternative production route. A third may need better visibility into parts sent for external processing so that a delay can be identified before it disrupts the production schedule.

The answer depends on the consequences of failure, the time required to recover and the cost of building an alternative.

Resilience is not the opposite of efficiency. It is the ability to preserve the value of an efficient operation when its normal assumptions no longer hold.

The difference between an alternative and a usable alternative

Many factories believe they have alternatives. The important question is whether those alternatives can actually be used when needed.

A plant may have another machine capable of performing the same operation, but the required fixture may not be available. The programme may need validation, the operator may not be trained, or the alternative process may require a different inspection method. Until these issues are resolved, the capacity is only theoretical.

The same applies to suppliers. A potential alternative may be listed in a procurement system, but if the material has not been approved or the supplier cannot deliver the required volume, it may not be a practical option during a disruption.

Consider a component that passes through a specialised heat-treatment process. The factory has two approved suppliers, but most of the work goes to one because it offers better pricing and shorter lead times. When that supplier experiences a breakdown, the second supplier appears to provide an immediate alternative. Yet it may not have enough capacity to handle the entire requirement, and the factory may need to reconsider how it allocates the available parts across customer orders.

Having two suppliers does not automatically mean that supply is resilient. The factory must understand the capacity, lead time, approval status and limitations of each source.

The same principle applies to production equipment, material substitutes, information systems and people.

A contingency plan should therefore be more than a document listing possible alternatives. It should establish what can be moved, what approvals are required, what resources are needed and how long the transition would take. For critical operations, the factory should test those assumptions before the disruption occurs.

Not every scenario needs an elaborate simulation. A practical review of one recent failure can reveal where the supposed alternative was unavailable, what information was missing and which decisions took too long.

The purpose is to replace assumptions with a realistic understanding of recovery capability.

Recovery is a business decision

When a machine fails or a critical material is delayed, the immediate priority is usually to restore normal operations. But the fastest technical recovery is not always the best business recovery.

Suppose two production orders are affected by a machine breakdown. One is due to a customer next week; the other has several weeks of schedule flexibility. The factory has limited alternative capacity. It may be possible to recover both orders eventually, but not without changing the production sequence.

The decision should consider delivery commitments, available inventory, downstream dependencies, customer impact and the cost of recovery. Restarting the machine is necessary, but deciding which work to prioritise determines how effectively the factory uses its remaining capacity.

These decisions become difficult when information is scattered across maintenance records, production schedules, inventory systems and quality reports. The maintenance team knows when the machine may be available. The planner knows which orders are affected. Procurement knows the status of the missing material. The customer-facing team knows which deliveries are most sensitive. Yet no one may have a complete view of the situation.

The result is often a series of escalations before a decision can be made.

Resilience requires clarity about who can make these decisions and what information they need. It also requires an understanding of the recovery time the business can tolerate for critical operations. A process supporting a customer with almost no buffer stock may need a very different recovery strategy from one producing components that can safely wait in inventory.

Not every disruption can be resolved quickly, and not every alternative will be economical. What matters is that the factory can assess the situation, make a deliberate choice and coordinate the response without losing unnecessary time.

This is where the responsibilities of the plant head, operations leader, supply-chain team and senior management come together. Resilience is not simply about restoring a machine or replenishing a missing material. It is about protecting the operation's ability to fulfil its commitments.

Digital visibility helps, but it does not create resilience by itself

A connected factory can monitor machine status, production output, quality events and maintenance requirements in real time. These capabilities are useful, but visibility is only the beginning.

When disruption occurs, the team needs to understand what the event means for the rest of the operation. Which orders are affected? Which components are already available? Which parts are waiting for external processing? Can another machine perform the operation? What happens to the delivery plan if recovery takes another day?

If the information required to answer these questions sits in disconnected systems or depends on individual knowledge, the factory may still react slowly despite having extensive digital monitoring.

This is where digital transformation should support resilience. The aim is to connect operational events with their consequences, make dependencies visible and help the organisation act on the information.

Traceability is particularly important when a quality issue affects a batch of components. The factory must identify where the affected material has gone, which products may be exposed and what needs to be inspected or contained. Without reliable records, the response may either miss affected parts or unnecessarily hold a much larger quantity of inventory.

System recovery matters too. As manufacturing becomes more connected, the factory must consider how production will be restored if an IT system or operational-technology environment becomes unavailable. Backups are valuable, but they need to be tested, and the business must understand which systems are essential to safe and effective production.

The NIST manufacturing cybersecurity and recovery guide provides a useful reference for this aspect of resilience.

Technology cannot decide which risks are worth protecting against or how much the business should spend on contingency capacity. Those remain management decisions. What technology can do is give the people making those decisions a clearer picture of the operation and the options available to them.

A factory should become stronger after a disruption

Restoring production is not the same as improving resilience.

Imagine that a factory suffers a machine failure, works overtime to recover its orders and returns to its normal schedule. If the review ends when production resumes, the underlying weakness may remain. The spare part may still be unavailable locally, the alternative machine may still be unqualified, and the planning team may still have no reliable way to track parts at external processors.

The next failure will trigger much the same response.

A useful review asks why the disruption had the impact it did. Was the original failure avoidable? Was its effect increased by a single point of dependency? Did the team have the information needed to act? Was an alternative available but not ready for use? Did decisions take longer because responsibility was unclear?

The answers help distinguish between risks that can be reduced and risks that must be managed.

A factory cannot prevent every supplier disruption, but it may be able to qualify an alternative for a critical component. It may not be economical to duplicate a specialised machine, but it may be possible to hold selected spare parts or validate a different production route. It may not be practical to eliminate every manual process, but cross-training can reduce dependence on one individual.

The lesson from each disruption should become part of how the factory operates. Otherwise, experience remains with the people who handled the crisis instead of improving the organisation's ability to deal with the next one.

This is also why the review should extend beyond the department where the problem began. A maintenance failure may expose a planning weakness. A supplier delay may reveal poor visibility into external processing. A quality incident may show that traceability is insufficient. A system outage may reveal that critical operating knowledge exists only inside an application that no one has a tested way to replace.

The factory becomes more resilient when these connections are understood and the operating model is improved accordingly.

Designing flexibility into the factory

There is a difference between finding an alternative after a disruption and designing a production system that can accommodate change.

Honda's manufacturing history offers a useful example. Its engineers developed modular production technologies that made it possible to manufacture different engine models on flexible transfer lines. This represented a move away from production arrangements dedicated to a single model towards systems that could handle mixed production more effectively.

Honda's historical account of modular transfer lines for engine components describes this development. Its broader history of production technology and flexible manufacturing explains how modular equipment and automatic changes between machining configurations expanded the range of products that could be manufactured on the same system.

Honda has continued to explore this principle for newer manufacturing requirements. Its Flexcell production system is designed to accommodate changes in production volume and specifications by adding or rearranging production cells while allowing other activities to continue.

These systems do not eliminate every disruption. A missing component, a quality failure or a major equipment problem can still affect output. Nor does flexibility mean that every machine can manufacture every product without preparation.

The important point is that the ability to adapt has been considered in the design of the production system itself. The factory is not relying entirely on people to find a workaround after conditions change.

The same principle can be applied beyond the physical production line. Alternative suppliers can be qualified before they are needed. Special-process movements can be tracked so that delays are identified early. Production routes can be validated in advance. Critical knowledge can be documented and shared. Recovery procedures can be tested rather than assumed to work.

These capabilities require investment and discipline, but they can reduce the time and disruption involved in adapting to new conditions. They also allow management to make a more informed trade-off between the cost of flexibility and the consequences of being unable to respond.

A resilient factory is not necessarily the factory with the most spare capacity. It is the factory that has deliberately created the flexibility needed to protect its most important operations.

Start with one disruption

You do not need to begin by assessing every possible risk in the business. Choose one recent event that disrupted production, delayed delivery or exposed a dependency you had not fully understood.

Use the Resilient Factory Canvas to reconstruct what happened. Identify the affected machine, material, supplier, process or system, then follow the consequences through production, planning, quality and customer commitments. Establish what information was available, which alternatives could actually be used and how long it took to recover.

The most useful part of the exercise is deciding what needs to change. Perhaps a spare part should be stocked, an alternative supplier qualified, a production route validated or the status of parts sent for external processing made visible. Perhaps the factory needs a clearer recovery decision process or a tested method for restoring a critical system.

The action should be specific, assigned to an owner and reviewed for its expected effect. The aim is not to produce a long risk register. It is to turn one real experience into a practical improvement in the way the factory operates.

Resilience is a capability, not a promise

Toyota's experience after the 2011 earthquake showed how a disruption in one part of a supply network can affect production across the world. Honda's flexible production systems illustrate another side of the problem: some of the flexibility required to respond to change can be designed into the manufacturing system long before it is needed.

Between those examples lies the work every manufacturing organisation must do. It must understand its dependencies, know where alternatives are genuinely available, make recovery decisions with the right information and learn from events that expose weaknesses.

Efficiency remains essential. Responsiveness allows the factory to adapt when conditions change. Resilience determines how well it can continue and recover when a disruption threatens its ability to deliver.

A factory is not resilient because it has never stopped. It is resilient because it understands what could stop it, has prepared for the dependencies that matter, and can recover without allowing one failure to become a crisis across the business.

The question to take back to your factory is simple:

If one critical machine, supplier, process or system became unavailable tomorrow, how much of your operation could continue — and how long would it take to recover the rest?