A&D ORCHESTRATION / RESEARCH BRIEF

From operational contradiction
to measurable experiment.

Inspired by Altshuller & M. Goldratt

Made by Eddington Roman A.

From operational contradiction to measurable experiment

A&D Orchestration is an independent portfolio research prototype by Eddington Roman A. It combines a durable synthetic workflow with an offline crisis laboratory. The purpose is to test the consequences of explicit decisions, rather than to claim a universal solution to complex operations. The three corporate incidents supply context and failure mechanisms. They do not supply private transaction histories, fitted arrival distributions or evidence that A&D was deployed at those companies.

A disciplined relationship between TRIZ and TOC

The Theory of Constraints focuses attention on the limiting part of a system: identify it, exploit the available resource, subordinate other decisions, elevate capacity when justified and reassess. TRIZ supplies a structured way to formulate contradictions and develop alternatives. Here, the analyst formulates the contradiction and selects an intervention; the simulator does not discover an optimal policy or implement the complete TRIZ methodology. The mapping from method to code is explicit: controlled release bounds the execution buffer, deadline ordering segments the work, progressive back-off separates recovery attempts in time, and temporary additional capacity tests elevation.

Experimental design and equal treatment

Each incident-inspired mechanism runs under three demand levels: 75%, 100% and 125% of the assumed base arrival rate. For each level, 32 paired seeds generate the same requests, deadlines, duplicate deliveries and service durations for all three policies. Arrivals occur over six simulated hours and outcomes are observed over twelve hours. Service durations are discrete uniform values from three to seven minutes; 25% of requests have a 60-minute deadline and the others have 180 minutes. A synthetic 10% duplicate-delivery probability is deduplicated by every policy. No real customer actions occur.

Policies and resource accounting

Basic retry uses first-eligible ordering, a maximum of six attempts and two-minute retry delays. Flow control uses the same attempt limit and base worker capacity, earliest-deadline ordering, a buffer capped at twelve requests including retries and running work, retry delays of 5, 10, 20, 40 and 60 minutes, and a ten-minute dispatch pause after three consecutive failed completions. This pause responds to observed failures; it does not inspect the future outage schedule. Flow plus extra capacity adds one worker only during the stated recovery window. Every provisioned worker-minute is counted, including idle time; running tasks are allowed to finish when nominal capacity falls. No dollar savings are inferred from these abstract resources.

What the measurements can and cannot say

SLA attainment uses every unique arrival as its denominator. Failed and unfinished requests do not disappear. Mean accumulated queue time counts held, queued and retry-wait minutes for every request up to completion, review or the observation boundary; it excludes service time. A policy that fails early can therefore have deceptively low waiting time. Completed-only P95 lead time has the same selection limitation. Completion, review, pending work, attempts and resource minutes must be read together. The displayed P10–P90 ranges describe variability across 32 assumed workloads, not confidence intervals for a real company. Paired differences compare matching seeds. The plotted trajectory always uses seed zero, not a hand-picked favorable run.

Historical evidence and counterfactual limits

These are mechanism experiments inspired by documented events, not validated reconstructions. A claim that a policy would have improved a historical company requires information we do not possess: capacity, topology, demand, constraints, concurrent decisions and actual outcomes. We can report a difference inside this model and explain what caused it. We cannot translate it into a historical reduction in delays, avoided losses or a client testimonial. In particular, no 40% target is built into the model. Unfavorable results remain visible.

AWS — When recovery traffic becomes the constraint

AWS reported that a connection surge congested networking devices between internal and main networks. Latency and errors induced further connection attempts and retries; monitoring was also affected. AWS described traffic mitigation and fixes to client back-off behavior. Our experiment does not reproduce its network topology or measure the impact of its actual remediation.

Three workers; outage from minute 60 to 180; expected arrival rate 0.42 requests/minute; service duration uniformly 3–7 minutes. Extra capacity: one worker from minute 180 to 360. These are invented experimental inputs, not AWS measurements.

More attempts may recover work, but they also consume the scarce dependency capacity needed for recovery. Separation in time: distinguish normal dispatch from recovery attempts and space those attempts. This is our TRIZ-informed design interpretation, not an automatic contradiction-matrix result. Identify execution as the constrained step; protect it with a retry budget and paced release. Additional capacity is tested separately and cannot restore an unavailable dependency.

At nominal demand, the median paired completion difference for flow control versus basic is 43.0 requests; SLA attainment changes by 22.2 percentage points. Its median paired queue-time reduction is -1290.5% (a negative reduction means more waiting). With extra capacity the median paired SLA change versus basic is 22.5 points. These are generated synthetic results, not measured corporate outcomes.

A single synthetic dependency stands in for one failure mechanism. There is no model of AWS networking, DNS, monitoring or distributed recovery. No claim that A&D would have prevented this outage.

Maersk — Recover the backlog without losing the priorities

Maersk reported IT systems down across multiple sites and selected business units following the June 2017 cyberattack. Its update described containment, technical recovery work and business-continuity plans. The company's documented response included shutting down systems and prioritizing continuity. Our experiment starts from an abstract service interruption; it does not simulate malware or security defenses.

Thirty synthetic requests arrive at minute zero; three workers; dependency unavailable until minute 180; expected arrivals 0.35/minute until minute 360. One extra worker is available from minute 180 to 360 only in the relief policy.

Releasing every accumulated request immediately feels fast, but it can bury urgent work behind an undifferentiated backlog. Segmentation: split requests by their explicit deadlines and separate held, executing and retrying work. The proposed adaptation is authored for this experiment, not attributed to Maersk. Protect the recovering execution step, subordinate release to its buffer, then evaluate a temporary capacity increase. Recheck whether deadlines or capacity become the limiting factor.

At nominal demand, the median paired completion difference for flow control versus basic is 80.0 requests; SLA attainment changes by -13.1 percentage points. Its median paired queue-time reduction is -396.3% (a negative reduction means more waiting). With extra capacity the median paired SLA change versus basic is 3.1 points. These are generated synthetic results, not measured corporate outcomes.

A synthetic request queue cannot represent vessel movements, terminal operations, IT restoration or the financial impact of a global cyberattack. No historical improvement estimate is inferred.

JD.com — Protect service when fulfillment capacity contracts

JD reported that its Shanghai fulfillment capability was recovering but remained below its pre-lockdown level. Its April 24 update described reopening nearby warehouses and bringing additional frontline employees to the city. Mobilizing resources was part of JD's reported response. The additional worker in our model is an abstract assumption, not a reconstruction or evaluation of JD's actual staffing plan.

Three workers normally, reduced to one from minute 60 to 300; expected arrivals 0.42/minute. Existing tasks finish when capacity drops. Relief adds one worker from minute 120 to 300. No dependency outage is injected.

Accepting more demand maintains access to service but increases the queue when fulfillment resources are restricted. Dynamization: test a temporary resource configuration instead of assuming constant capacity. Resource availability is an explicit scenario assumption, not something software can create. Identify reduced fulfillment capacity; prioritize and pace admission; test elevation with one additional worker. All upstream waiting remains counted and capacity minutes expose the cost.

At nominal demand, the median paired completion difference for flow control versus basic is 0.0 requests; SLA attainment changes by 18.4 percentage points. Its median paired queue-time reduction is 0.1% (a negative reduction means more waiting). With extra capacity the median paired SLA change versus basic is 18.6 points. These are generated synthetic results, not measured corporate outcomes.

This is a queue-level analogy. It omits geography, inventory, transport routing, safety rules and legal movement restrictions. A&D cannot remove those real constraints.

Operational sustainability and conclusion

The crisis experiments are computed offline and shipped as versioned static artifacts. Browsing them adds no Supabase writes and does not call the source websites. The separate live synthetic workflow persists checkpoints on a fifteen-minute schedule once its OVH engine and n8n workflow are activated. That workflow retains its own model version and assumptions; it is not one of the historical cases. This separation makes the portfolio maintainable and keeps a current simulation distinct from a dated research experiment. The useful output is an auditable decision: what constraint was targeted, what changed, what was measured and what trade-off remained.

Sources

Model AD-CRISIS-1.0 · Seeds 0–31 · 864 policy-runs. Use your browser's Print command to save a PDF.

Source SHA-256: 91dbf83b423d0282be05b7d027db864363bb30d0a00e5718cc59e1aab7b909a8