Identifying Risks and Mitigating Disruptions in the Automotive Supply Chain

Many companies face considerable operational and supply chain risks that can materially impact company performance. Given the complexity and scope of Ford Motor Company’s operations, this is certainly its situation. Ford maintains more than 50 plants worldwide that annually utilize 35 billion parts to produce six million cars and trucks. It has up to 10 tiers of suppliers between itself and its raw materials. Its Tier 1 suppliers number 1,400 companies across 4,400 manufacturing sites. A lengthy disruption anywhere in this extended supply chain can have significant financial repercussions for Ford. A disruption to one of its second-tier suppliers during the 2011 Thailand floods elevated the importance of this issue. As a result of this disruption, Ford idled global production for one of its most profitable product lines.

Ford is one of many companies exposed to such disruptions. For example, the 2011 flooding in Thailand led Intel to cut its quarterly revenue target by $1 billion (Tibken2011). Driven in part by greater global trade and the adoption of lean operating principles, many companies now operate with globally dispersed manufacturing facilities and extended supply chains. Normal accident theory holds that because major disruptions are an inherent property of such complex and tightly coupled systems, they should be considered unavoidable or normal (Perrow2011). It falls to operations and supply chain managers to navigate this new normal. Traditional operational-disruption risk-assessment methods oblige firms to identify the probability and magnitude of disruption risks early in the analysis process (Sampson and Smith1982, Knemeyer et al.2009); however, managers face a number of challenges in implementing such a solution. First, it is difficult and often impossible for managers to accurately estimate the likelihood of low-probability, high-impact disruptive events (Banks2005, Taleb2007). Second, managers tend to misallocate resources when facing low-probability events (Kahneman and Tversky1979, Johnson et al.1993), ignore risks regardless of their potential significance (March and Shapira1987), and distrust or disregard precise probability estimates (Kunreuther1976, March and Shapira1987). This can lead to inaction; Mitroff and Alpaslan (2003) found that most firms do little to proactively prepare for such low-probability, high-impact disruptive events.

In this paper, we apply a new model, proposed by Simchi-Levi in March 2012 (Gilmore2012) and described in Simchi-Levi et al. (2014), for analyzing operational-disruption risk and detail the development and implementation of this model at Ford. Throughout the paper, we share the primary results of our analysis using masked versions of Ford’s operational and supply chain data.

Literature Review

We leverage two streams of research in our work. The first area of scholarship pertains to supply chain network modeling and optimization, which broadly consider the optimal network structure under steady state operations (Fisher et al.1997, Graves and Willems2003) or under the possibility of a disruption (Snyder et al.2006, Peng et al.2011, Mak and Shen2012). Closely related is research that evaluates coordination strategies between buyers and suppliers in the presence of disruption risk (Tomlin2006, Chopra et al.2007, Tomlin2009). Less attention has been given to evaluating the impact of a disruption based on the optimal response of an existing network once that disruption has occurred. A recent exception is Schmitt (2011), which evaluates response strategies that minimize the service-level impact when disruption occurs on a multiechelon network for a random duration. Another is MacKenzie et al. (2014), which evaluates the interaction between the supplier and buyer response strategies under a random-duration disruption.

We make three important contributions to this literature. First, we develop our model for practical applications using large-scale supply chain data from Ford. Second, we evaluate the optimal contingency plans for settings in which the disruption duration is either known exactly or described by an uncertainty set. Finally, our model quantifies the disruption exposure across all the nodes in the company’s supply chain based on company-level performance impacts.

The second stream of research seeks to classify operational disruptions and quantify their impact. Scholars and practitioners generally agree that operational disruptions materially and negatively impact company performance on average (Sheffi2005, Hendricks and Singhal2005, World Economic Forum2013). There is less agreement, however, on how we should classify and forecast such disruptions (Kleindorfer and Saad2005, Tang2006, Wagner and Bode2006, Sodhi et al.2012). Researchers are only beginning to understand which disruptions have the greatest impact on firm performance. Answering this research question is important because it informs firms on which disruptions warrant mitigation investments. Craighead et al. (2007) propose that supply chain density, complexity, and node criticality contribute to the severity of disruptions. Tang (2006) theorizes that a firm’s vulnerability to disruption depends on its supply chain strategies, including postponement strategies and inventory placement. Braunscheidel and Suresh (2009) identify that a firm’s organizational integration practices are associated with the firm’s ability to mitigate the consequences of disruptions. Kleindorfer and Saad (2005) provide evidence that changes to risk-assessment and risk-mitigation practices reduce the impact of disruptions in the chemical industry.

We contribute to this body of research by identifying the specific nodes in a firm’s operations and supply chain that would, if disrupted, result in the greatest damage to firm performance. We believe that this result is particularly beneficial in an applied setting because it allows firms to understand their exposures at specific operational locations and put in place countermeasures that address the greatest sources of exposure.

Our research generally aligns with concepts applied in other disciplines, including estimating maximum foreseeable loss (i.e., the maximum loss if all safeguards in a system break) in the insurance industry and conducting failure analysis (i.e., assessing the structural resilience when a critical member of a system is removed) in structural design. Until now, however, the field of operational risk management has not given these principles much attention.

Limitations of the Legacy Risk-Analysis Approach

For many companies, even those that have world-class operations and supply chain management systems, proactively managing high-impact, low-probability disruption risks is challenging. One obstacle to conducting a more insightful analysis of disruption risks is that operational disruptions are both difficult to predict and have a highly uncertain impact on performance. In Ford’s case, the scale and dynamic nature of its supply chain further complicate this problem. These factors increase both the number of disruption scenarios to consider and the frequency at which we should evaluate those scenarios. A second obstacle is data availability, particularly on suppliers at lower tiers within the supply chain. Supply chain transparency is a challenge for the entire automotive industry. Suppliers to the industry have historically been reluctant to provide the automobile manufacturers with detailed information about their suppliers and their suppliers’ suppliers. As a result, although manufacturers typically have good information on Tier 1 suppliers (i.e., companies that supply directly to the manufacturer), they have considerably less information on lower-tier suppliers in the supply chain.

Given these limitations, legacy risk-management processes often focus on tracking the status of only a handful of suppliers and part numbers. These tend to be suppliers that provide major assembly components and represent a large portion of the total component costs. Many large manufacturers recognize that material exposures are likely to be hidden among the suppliers who are not included in this regular review process. Because of the difficulties in predicting disruptions, the data limitations, and the size of their supply chains, companies often cannot identify where these exposures are, much less quantify their impact. For example, managers at Ford estimate that conducting a traditional risk analysis for all of Ford’s more-than-4,000 Tier 1 supplier sites would likely take two or three years, at which time the analysis would be obsolete.

Our Approach: Risk-Exposure Index

Recognizing that managers have limited ability to predict low-probability, high-impact risks or collect detailed data on lower levels of their supply chain, our approach, initially described in Simchi-Levi et al. (2014), advocates integrating a vulnerability-based analysis into supply chain risk assessments. In such an analysis, the focus is on understanding the impact of a disruption, regardless of its source. This defers the need to estimate the probability associated with any specific risk and collect detailed information from subtier suppliers until after Ford has determined the impact a disruption will have on its operations. At that point, Ford can make a more informed decision about where to focus its limited risk-assessment resources. Our approach suits the goal of analyzing supply chain disruptions because the impact of a disruption often does not depend on the cause of the disruption but rather on its duration. In addition, the potential mitigation actions that a company can practically employ in response to a supply chain disruption are often the same regardless of the specific causes of the disruption. Finally, our approach implicitly recognizes that supply chains are in a continuous state of flux. In the face of such constant change, maintaining up-to-date predictions of the likelihood of specific risks is nontrivial; however, given that a disruption does occur, estimating a firm’s vulnerability is more tractable.

Time-to-Recover Model

The model considers the supply chain as a graph representing the movements of supplier parts from each supplier facility to each of a firm’s facilities and product lines. A node, also referred to as a stage, in the graph is equivalent to a part or manufacturing process at a particular supplier or Ford facility. Inputs to the model include operational and (or) financial measures (e.g., unit profitability) and in-transit and on-site inventory levels for each node. Our model incorporates the time-to-recover (TTR) of each node in the supply chain network, which represents the time it takes for a node to recover to full functionality after a disruption (Miklovic and Witty2010, Simchi-Levi et al.2014). This value can be unique at each node in the firm’s supply chain.

The model iterates over each node in the graph, disrupting the node for the duration of its TTR and calculating the corresponding impact on the firm’s performance. It determines the performance impact assuming the firm responds optimally to the disruption scenarios, where the model simulates the optimal responses by solving an associated linear optimization problem; see Appendix A for details. The model can accommodate different performance measures as the objective for this optimization, including minimizing the lost units of production, lost sales, or lost profit margin. For each disruption scenario, the model searches on how to reallocate existing inventory, redirect supply alternatives, and idle downstream plants such that the disruption has the smallest impact. The resulting performance impact (PI) is the impact of that disruption scenario on the firm’s chosen performance measure during the TTR. To simplify cross-scenario comparisons, the model can also calculate a risk-exposure index (REI) (Simchi-Levi et al.2014), which normalizes the PI for each scenario by the maximum PI over all scenarios considered in the analysis.

The model can accommodate simultaneous disruptions in multiple supply chain nodes. This allows management to analyze complex disruption scenarios, including disruptions that affect all the parts from one supplier plant or disruptions that affect all the same part regardless of the supplier. We can extend the model to account for alternative sources of supply and supplier capacity commitments. This facilitates an explicit examination of interactive effects, which may occur when multiple firms try to adjust to supply disruptions at the same time. For example, if a supplier fails to deliver to one firm, it may have gone down for multiple firms. Such an event makes other potentially compensating nodes (e.g., backup suppliers) more congested.

Time-to-Survive Model

In many cases, accurate TTR information may not be available. More importantly, a supplier may be optimistic when assessing its TTR; that is, a supplier may underestimate the time required to recover and hence may underestimate Ford’s exposure to a disruption. Therefore, Ford is interested in identifying suppliers whose disruption impact is sensitive to the given TTR information. For this purpose, we introduce the time-to-survive (TTS) concept, which we define as the maximum amount of time the system can function without performance loss if a particular node is disrupted (Simchi-Levi et al.2015). As we will show, we determine the TTS associated with a specific node by solving an optimization problem that takes into account the disruption of this node, inventory levels, and alternative sources of supply; see Appendix B for the model formulation. The firm can determine whether a more accurate measure of TTR is necessary by comparing the TTS value associated with a specific node with the TTR estimate of that node. If the TTS far exceeds the TTR, it implies that a large change in TTR will have little impact on the firm’s risk exposure; however, nodes with short TTS values require Ford to engage these suppliers in a detailed discussion about their TTRs.

Implementation at Ford

We implemented our model as a decision support system during a three-year research engagement between MIT and Ford. The first phase of the project included the assessment of existing risk-management approaches. In the second phase, we worked with the Ford optimization and information technology (IT) teams to focus on model design and implementation, and the integration of the optimization model and Ford’s IT system. The modeler and optimization specialists communicated weekly, and received help from Ford’s procurement team to validate the model’s output.

Ford’s procurement staff used the decision support system in three ways: (1) strategically, to identify exposure to risk associated with parts and suppliers, effectively prioritize and allocate resources, segment suppliers, and develop mitigation strategies; (2) tactically, to track daily changes in risk exposure to alert procurement executives to changes in their risk position; and (3) operationally, to identify effective ways to allocate resources after a disruption. Using the model to conduct a comprehensive analysis of its risk exposures (i.e., the strategic level), Ford identified several supply chain nodes that would have a large impact on its operations if disrupted. These large exposures lie in unlikely places, such as nonstrategic suppliers or parts that the company spends relatively little money to procure. Armed with this information, Ford can make more informed decisions on how to deploy its risk-assessment resources and mitigate the effects of a disruption to these nodes.

In this section, we describe the insights our model provides at the strategic, tactical, and operational levels for Ford’s risk-analysis, procurement, and management teams.

Evaluation of Node Criticality with the TTS Model

As discussed in the Time-to-Survive Model section, TTR information is not known accurately in many practical situations because of information uncertainty and optimistic supplier assessments. Therefore, the first step of our risk-analysis process is to identify the disruption scenarios that would lead to immediate performance deterioration, namely, to find nodes with small TTS values. Nodes that represent higher exposure levels will have a TTS value that is lower than a threshold value, for example, TTR plus a safety allowance.

Figure 1 shows that the suppliers included in the analysis have a range of TTS values. Many suppliers have TTS values of less than one week. Ford’s management can use this information to concentrate on the PI of low-TTS suppliers and acquire corresponding TTR information. In addition, by identifying the nodes with high TTS values, this analysis can identify potential waste, caused by excessive protection (strategic inventory), within the system. For such nodes, a firm may reduce (strategic) inventory, thus providing significant cost savings.

Application to Strategic Decisions

Strategically, Ford utilizes the TTR model to identify the risk exposure of parts and suppliers, allowing it to prioritize resource allocation. Furthermore, by combining the risk exposure of suppliers with other information, such as the total spend at various supplier sites, Ford gains insights about possible mitigation strategies it could adopt toward various types of suppliers. Next, we describe these applications of the model to Ford.

Figure 2 is based on the PI output (in this case, lost sales measured by the impact of vehicle-production volume) from a model run, including all the critical suppliers and Ford plants that support Ford’s North American assembly plants. As the figure indicates, a significant portion of the suppliers do not expose Ford to any risk; however, more than 400 sites have very high PIs.

In Figure 3, we take a closer look at these suppliers with very high PIs and see that some of the largest exposures reside in unlikely places, such as the production and (or) procurement of low-cost, commoditized parts. Therefore, some of the traditional risk-mitigation strategies (e.g., focusing on high-spend suppliers) may lead to wasteful resource allocation at low-exposure sites and insufficient protection at high-exposure sites.

Figure 3 suggests that Ford should reduce its exposure to risk by segmenting suppliers into three categories depending on the supplier’s PI and total spend. Each segment presents a different set of challenges; therefore, Ford should use different mitigation strategies, as Figure 4 illustrates. First, suppliers on the left side of the chart have low exposure; therefore, Ford’s primary actions in many of these cases should involve signing long-term supply contracts and tracking inventory.

Supplier sites with high total spend and high PI are at the top right side of the chart. This segment includes, for example, suppliers of seats and instrument panels. These items strongly affect the customer experience, and their prices represent a large portion of the total manufacturing cost. We typically refer to them as strategic components and their corresponding suppliers as strategic suppliers. For many companies, this segment represents 20 percent of their suppliers, which accounts for about 80 percent of total spend. Typically, each of these components has a single strategic supplier. An appropriate supply strategy for these items is to focus on long-term partnerships with suppliers and implement effective supply contracts where Ford can share risks with suppliers and track performance. Importantly, because of the high total spend with these suppliers, Ford may be able to compel some of these suppliers to have backup supply sites in different regions.

The most challenging suppliers are those whose total spend is low and PI is high (i.e., suppliers at the bottom right side of the chart). To ensure supply, a firm may invest in inventory, require the supplier to have dual sites in different regions, or apply a dual-sourcing strategy. Unfortunately, each of these mitigation strategies may cause a problem. Investing in inventory may not be consistent with the lean strategy the company is applying. Low total spend implies that the firm is not in a good position to require the supplier to have multiple sites. In addition, some of these suppliers are associated with high-volume, low-cost, and low-margin components. For these components, competition typically shifts to a few manufacturers that dominate the market because of their lower costs and superior quality; as a result, engaging in a dual-sourcing strategy is difficult. In our experience, one possible mitigation strategy involves a new product design in which components are standardized, allowing the firm to shift more volume and more spend to the supplier; hence, the firm would be in a good position to require dual sites.

Application to Tactical Decisions

Recall that for some components, risk exposure is directly proportional to the level of inventory of that component in Ford’s supply chain. To identify risk exposure, pipeline inventory information is uploaded to the system on a regular basis, and the system determines the performance impact by component anywhere in the supply chain. When performance impact is above a specific level, procurement specialists initiate a process to understand the reason and take corrective action. In that respect, our system serves as a control tower that allows the firm to monitor suppliers’ performance and inventory trends to take action before problems occur. Because the company takes actions in anticipation of a potential adverse event, it can minimize the financial impact if such events happen.

Application to Operational Decisions

Operationally, Ford supply-risk specialists use the model to respond to a disruption event. For example, a few months ago, political problems in one region motivated the procurement department to identify the high-exposure suppliers in that region and find alternative sources of supply for these components.

In such situations, our TTR model optimizes inventory and capacity allocation decisions when a disruption occurs (Appendix A), assuming that accurate TTR information is available immediately after a disruption occurs. Unfortunately, TTR may be different for different modes of disruptions (e.g., process disruption versus tooling damage), and the firm may not know the exact TTR value when a disruption occurs. Therefore, identifying robust allocations of inventory and capacities under such uncertainty in TTR values is important.

Figure 5 provides a stylized example that compares the impact of different resource-allocation strategies when the length of the disruption varies. In this figure, each curve represents the financial impact of one resource-allocation strategy. For example, the solid curve corresponds to the optimal resource-allocation strategy for TTR = 1; we evaluate the performance of this resource-allocation strategy for all TTR values between 0 and 2. Similarly, the dotted curve is associated with the optimal resource-allocation strategy when TTR = 0.7. Figure 5 suggests that neither of the two strategies dominates; that is, neither strategy outperforms the other on all TTR values between 0.7 and 1. This is not always the case. Another stylized example (Figure 6) shows that the strategy associated with the solid line outperforms the strategy associated with the dotted line. The former strategy outperforms all other strategies for TTR values between 0 and 2 (Figure 6 does not show other strategies); that is, the solid line either matches or dominates the performance of any other resource-allocation strategy determined by using a single TTR value between 0 and 2.

Motivated by these different cases, we developed an algorithm that can (1) find a dominating strategy if it exists, or (2) find a Pareto-optimal strategy, which always exists. That is, managers can specify the ranking of potential TTR values, and the algorithm provides a strategy that is not dominated by any other strategy. We describe the algorithm in Appendix A. We also refer the reader to Zhang (2015) for a more in-depth discussion.

System Architecture

To allow procurement and risk specialists to take advantage of our model, Ford developed a decision support system that integrates various databases, the TTR and TTS models, and a data-visualization software package. The data sources include Ford’s material requirements planning (MRP) system, its purchasing database, and sales-volume planning information. Figure 7 describes the system architecture in which various data sets, including bill of material, part routing, inventory levels, and plant vehicle volumes are used to map Ford’s supply chain. Gusikhin and Klampfl (2012) describe the basic methodology of mapping the Ford supply chain. Our optimization engine uses the results to generate the various performance impacts. These performance measures are then presented to the users by Tableau data visualization, which includes a geographic mapping capability. Thus, users can view results both in tabular form and in various graphical formats. Figure 8 provides a screenshot of our interface; the size of the circles identifies the performance impact of a disruption to the supplier in that geographic location. The two tables at the bottom of Figure 8 provide detailed information on suppliers and parts. For each supplier, the table on the left provides the vehicle affected, total spend at that supplier, financial impact, and production-volume impact if that supplier is disrupted for the duration of its TTR. The table on the right provides all affected parts associated with each supplier.

Procurement and risk specialists regularly use the system to track risk exposures in real time as inventory levels fluctuate and the supply chain structure evolves. The frequency of updates relies on the efficient data-integration technology developed by Ford and the computational tractability of our linear programming models (Appendices A and B).

Realized Benefits for Ford

Ford spends several million dollars per year to proactively manage its operational and supply chain risk. Two points make clear why Ford must deploy its risk-management resources in the most effective manner possible. First, it must spread these resources across a huge operational footprint. Ford’s operations and supply chain include more than 4,400 Tier 1 supplier sites, hundreds of thousands of lower-tier suppliers (Tier 2 and lower), more than 50 Ford-owned facilities, 130,000 unique parts, 35 billion total parts annually, and more than $80 billion annually in external procurement costs. Second, the cost of failure can be huge because supply chain disruptions can have a significant impact on Ford’s ability to match supply with demand. Indeed, Ford estimates that the lost revenue associated with a disruption can be significant. To illustrate this point, recall that in 2011 Toyota lost 800,000 units of production volume as a result of the Japan earthquake and more than 240,000 units of production volume as a result of the flood in Thailand. Honda faced similar challenges (Schmidt and Simchi-Levi2013).

The risk-exposure model produces important and tangible benefits for Ford to help it effectively identify and manage its risks. First, Ford has identified supplier sites that have a material impact if disrupted, but that it did not recognize as high-exposure sites. Based on the model results, 2,600 Tier 1 supplier sites have nonzero vehicle-volume impact that, if disrupted, would adversely impact Ford’s revenue by up to $2.5 billion. Ford now classifies these exposures as high-priority issues that require a formal remediation analysis. Identifying these suppliers is particularly compelling because they represent 1,500 additional supplier sites that will now receive a larger share of Ford’s risk-management resources. Identifying and addressing such risk exposures directly supports Ford’s corporate strategy.

A second benefit is identifying low-exposure supplier sites that are currently receiving an excessive allocation of Ford’s risk-management resources. The model has identified over 400 supplier sites that Ford includes in its risk-monitoring program, but which pose insignificant exposure to the company if disrupted. This information has allowed Ford to more efficiently allocate its supplier risk-management resources.

By reallocating these resources, Ford is better able to protect itself from the highest-impact exposures in its operations and supply chain. For example, the lost revenue associated with a two-week disruption to the newly classified high-impact supplier sites ranges from several hundred thousand dollars to $2.5 billion; in contrast, the lost-revenue impact associated with a two-week disruption to each of the formerly classified high-impact supplier sites is minimal. In the words of Ford manager Michael Sanders, “This has been one of the key game changers for us. This enables us to focus on the supplier sites which would have a high or very high impact on performance if disrupted, and lets us put all our resources and all our knowledge into making sure we have robust plans to protect us in the event that something happens with any one of those sites” (Simchi-Levi and Sanders2013).

Finally, our model detects hidden risks in Ford’s supply chain. For example, it identified a low-cost sensor that has high vehicle exposure; however, because of the low total spend, Ford’s procurement group was not paying much attention to this component. Following the risk analysis, the commodity team acknowledged the sourcing concentration and associated risk and developed a mitigation strategy.

Discussion

Firms operate in a constantly changing environment in which operational risks are increasing. In the automotive industry, four factors contribute to increasing levels of operational vulnerability. The first factor is the proliferation of global programs and the related need to maximize the operational scale of these programs. This results in less redundancy and more dependence on fewer suppliers, increasing the supply chain’s exposure if one of these suppliers is disrupted. The second is the ongoing consolidation in the supply base and the fiscal incentives to maximize the use of supplier resources. This also results in greater supplier concentration and less slack capacity for the most critical subtier manufacturing components, including electrical components, raw materials, and chemical precursors. Third, manufacturers’ efforts to push their Tier 1 suppliers toward lower costs ultimately drive those suppliers to pursue subtier sourcing in emerging markets. This further extends the manufacturers’ supply chains, adding more dependencies and potential points of failure. Finally, unlike the situation in the PC industry, in the automotive industry, no common standards are applied across other equipment manufacturers (OEMs) for electronic components; hence, very few suppliers are available for these components. Any supplier disruption can shut down Ford’s ability to match supply with demand.

The automotive industry is not alone in facing increased disruption risk. Trends toward more extended supply chains and reduced operational buffers are gripping many industries. As a result, supply chain executives have a dual mission—to systematically address extreme risks, such as hurricanes, epidemics, earthquakes, or port closings, and to manage operational risks, such as forecast errors, sourcing problems, and transportation breakdowns. Succeeding in this dual mission is difficult because company operations and supply chains are increasingly dynamic, and the occurrence and impact of disruptions are difficult to predict.

In this paper, we provide a new approach for supply chain risk management, which reduces the need to estimate the likelihood of low-probability, high-impact events. Our method focuses on evaluating a firm’s vulnerability, given that a disruption could occur anywhere across its supply chain. This approach helps Ford streamline and better target its operational-disruption risk-assessment process, deepen its understanding of its disruption risks across both its internal operations and extended supply chain, and rapidly and consistently assess its supply chain risk-mitigation initiatives. Ford also takes advantage of the model’s capability of running at various levels of detail. For example, in some applications, the company runs the model by aggregating nodes within a geographic region, and then drills down into more detail by running it using more granular representations for nodes.

Our risk-exposure model augments rather than replaces traditional risk-analysis methods. Ford incorporates the results of the model with other indicators that measure each supplier’s financial risk, including metrics for financial health, and steady state operational risk, including metrics for service level performance and quality control compliance. Suppliers that trigger one or more risk areas (i.e., disruption, financial, or operational) are identified for follow-up with Ford’s supplier risk-management team. By including the model in its broader supplier risk-analysis process, Ford can more confidently and accurately identify the areas in its supply chain and operations to allocate its limited risk-management and mitigation resources.

Appendix A. Time-to-Recover Model

We first present a single-tier (ST) supply chain model to illustrate some of the main concepts, and then extend it to a multiple-tier (MT) model that encompasses more components. The basic premise of both models is that, given a supply chain structure (a graph) and a disruption scenario (interrupted nodes and edges), we determine how to allocate the firm’s remaining resources to optimize its ability to satisfy exogenous demand. A node (or stage) in the graph is a component or manufacturing process at a particular supplier or assembly site; an edge is a directed flow of materials from an upstream stage to a downstream stage. We formulate both models as linear optimization programs. We summarize our notation for the single-tier model in Table A.1 and for the multiple-tier model in Table A.2.

Table A.1: This table lists the parameters and variables of the single-tier model and their explanations.

Table A.1: This table lists the parameters and variables of the single-tier model and their explanations.

Symbol	Explanation
Superscript(n)	Disruption scenario n.
𝒜	Set of all suppliers sites (plants).
𝒱	Set of all final nodes (vehicles).
ℱ(n)	Set of production edges under disruption scenario n.
t(n)	TTR for disruption scenario n.
ci	Total production capacity of node i per unit time.
si	Finished goods inventory of node i.
fj	Profit margin of product j.
dj	Demand for j (per time unit).
lj	Lost production volume of vehicle type j.
yij	Amount of product j produced at plant i.

Table A.2: This table lists the parameters and variables of the multiple-tier model and their explanations.

Table A.2: This table lists the parameters and variables of the multiple-tier model and their explanations.

Symbol	Explanation
𝒟	Set of all but the first-tier nodes.
𝒰	Set of all but the final nodes (vehicles).
𝒮(n)	Set of all disrupted nodes for disruption scenario n.
𝒜	Set of all suppliers sites (plants).
Aα	Set of all nodes produced at supplier and (or) plant α.
𝒱	Set of all final nodes (vehicles).
Vj	Set of all final nodes (vehicles) that are of the same type (j).
𝒩−(i)	Set of parts required to produce node i.
𝒩+(i)	Set of nodes that require node i.
𝒫jk	Set of all nodes that are in the upstream of node j and of part type k.
t(n)	TTR for disruption scenario n.
ui	Total production quantity of nodes i during time t(n).
lj	Lost production volume of vehicle type j.
yij	Allocation of upstream node i to downstream node j during time t(n).
si	Finished goods inventory of node i.
rkj	Number of type k parts required to make one unit of node j.
fj	Performance impact (e.g., profit margin) of one unit of product j.
dj	Demand for j per time unit.
ci	Production capacity of node i per unit time.

In the ST model, the firm has a set of plants (𝒜), which produce a set of products (𝒱). The firm’s objective for each disruption scenario is to minimize the impact of the disruption on its chosen performance metric. We capture this through the following linear program.

$$\begin{array}{l}\text{Minimize}{\displaystyle \sum _{j\in 𝒱}{f}_j{l}_j^{(n)}}\\ \text{s}\text{.t}\text{.}{\displaystyle \sum _{i:\text{}(i,\text{}j)\in {ℱ}^{(n)}}{y}_{ij}^{(n)}+l_j^{(n)}\ge d_j{t}^{(n)}-s_j,\forall \text{}j\in 𝒱,}\\ {\displaystyle \sum _{j:\text{}(i,\text{}j)\in {ℱ}^{(n)}}{y}_{ij}^{(n)}\le c_i{t}^{(n)},\forall \text{}i\in 𝒜,}\\ y_{ij}^{(n)},l_j^{(n)}\ge 0,\forall \text{}i\in 𝒜,j\in 𝒱.\end{array}$$

In this model, decision variable $y_{ij}^{\left(n\right)}$ is the cumulative production of j at plant i in disruption scenario n. Variable $l_j^{\left(n\right)}$ is the amount of lost demand for product j in disruption scenario n. Parameter $f_j^{\left(n\right)}$ refers to the impact of one unit of loss in sales for product j, for example, the profit margin; t⁽ⁿ⁾ is the TTR for this disruption scenario. d_j and s_j are the demand and inventory for product j, respectively. Flexibility design ℱ⁽ⁿ⁾ is the set of edges that are still alive during disruption scenario n.

The objective function is the minimization of the total weighted loss as a result of the disruption. The first constraint is a lower-bound constraint for the number of units lost for product j, given the production and inventory conditions. The second constraint is a total capacity constraint on the assembly plant i. We can replace the linear objective function with a convex one in a more general case, for example, accounting for lost market share if the loss exceeds a specific threshold.

Solving one instance of this linear program measures the impact of one disruption scenario. A crucial step of using this model is the construction of the set of disruption scenarios of interest. The identification of this set is a self-contained step that can be performed by the business executives and risk managers. For example, when the firm aims to identify the most crucial node of the system, the disruption scenarios are constructed as all events that relate to the removal of a single node from the graph. This is the paradigm adopted for the analysis at Ford.

Although the ST model explicitly captures only the last tier of the production system, it can be used to analyze a disruption at a supplier in an upstream tier. To do so, we disrupt the nodes in the final tier that depend on the upstream supplier, and solve ST. This is reasonable if the firm has little control over the nodes prior to the last tier and if the firm knows which final-tier nodes will be affected by the disruption. These assumptions may be too conservative, for example, in situations in which the firm has control over upstream resource allocation and routing. We present a multiple-tier model that addresses this more general case.

The MT model is similar to the ST model. We include the concept of parts, which refers to the set of nodes that are functionally equivalent in the manufacturing process, but potentially processed at a different plant or supplier site.

$$\begin{array}{l}\text{Minimize}{\displaystyle \sum _{j\in 𝒱}{f}_j}{l}_j\\ \text{s}\text{.t}\text{.}{u}_j-{\displaystyle \sum _{i\in {𝒫}_{jk}}{y}_{ij}}/r_{kj}\le 0,\forall k\in {𝒩}^{-}(j),\forall j\in 𝒟,\\ {\displaystyle \sum _{j\in {𝒩}^{+}(i)}{y}_{ij}}-u_i\le s_i,\forall i\in 𝒰\\ u_j=0,\forall j\in {𝒮}^{,}\\ l_j+{\displaystyle \sum _{k\in V_j}{u}_k}\ge d_j{t}^{(n)},\forall j\in 𝒱,\\ {\displaystyle \sum _{k\in A_{\alpha }}{u}_k}\le c_{\alpha }{t}^{(n)},\forall \alpha \in 𝒜,\\ l_j,u_j,y_{ij}\ge 0.\end{array}$$

The first constraint is a bill-of-materials constraint; for every node j, we limit the production of node j (denoted by u_j) by the most-scarce parent part. More specifically, for this node j (e.g., an engine), there are multiple parent nodes (e.g., components of an engine). Variable y_ij represents the material flow from node i to node j. If two parent nodes, i and i′, represent the same physical and (or) functional part (e.g., the same type of bolts from two different suppliers), we say that i and i′ are of the same part type. We invoke an additional index k to denote the part type of a node, and use r_kj to represent the amount of type k parts required to produce one unit of node j. The ratio y_ij/r_kj is then the units of node j that can be produced with y_ij units of type k parts from node i. We use 𝒫_jk to represent the set of all nodes that are (1) upstream of j, and (2) of part type k. Hence, ∑_i∈𝒫jky_ij/r_kj represents the maximum amount of j that can be produced, given the aggregated supply of type k materials from upstream nodes in 𝒫_jk.

The second constraint is also a bill-of-materials constraint, which limits the total outflow of node i (∑_j∈𝒩+(i)y_ij) to be less than the sum of production (u_i) and inventory (s_i) at the current location.

The third constraint is the disruption constraint, which limits the production of disrupted node j (i.e., u_j) to be zero. The fourth and fifth constraints are similar to the first and second constraints in the ST model.

In both the ST and MT models, we make the simplifying assumption that processing lead times are not significant relative to the impact of the disruption. In the MT model, we also assume that the costs of rerouting materials and manufacturing changeovers are not significant relative to the impact of the disruption. These are often reasonable assumptions in the context of high-impact disruptions, the effect of which dwarfs the impact of these other issues.

The ST and MT linear programs generate prescriptive contingency plans that minimize the impact of the disruption on the firm’s chosen performance metric. Under each disruption scenario, the optimization model generates a corresponding set of optimal values for the decision variables, denoting the best routing and resource-allocation plans for that disruption.

Procedure for Finding Pareto Efficient Solutions Under TTR Uncertainty

Given a finite set of n TTR values, (t₁, …, t_n), with t₁ being the largest, we can find a resource-allocation strategy that is Pareto efficient (i.e., not dominated by any other strategy) on this set of TTR values. This is in spirit the same as finding a lexicographically optimal solution in multiobjective optimization (Ehrgott2005), where the n objectives correspond to the performance impact under these n TTR values. Using x = (l/t, u/t, y/t) to represent the resource-allocation strategy, and f (x, t) and {x ∣ Ax ≥ b(t)} as the objective function and feasible region of the TTR model, respectively, we provide the procedure for finding a Pareto-efficient solution as follows.

Algorithm 1 (Pareto-efficient resource-allocation strategy algorithm)

1: Solve the original TTR linear optimization model with t = t₁, and obtain resource-allocation strategy x¹, which minimizes f (x, t₁) over the set {x ∣ Ax ≥ b(t₁)}.

2: Determine the strategy x², which minimizes f (x, t₂) over the set {x ∣ f (x, t₁) = f (x¹, t₁), Ax ≥ b(t₂)}.

3: For 3 ≤ k ≤ n, determine the strategy x^k, which minimizes f (x, t_k) over the set {x ∣ f (x, t_i) = f (xⁱ, t_i) for each 1 ≤ i ≤ k − 1, Ax ≥ b(t_k)}.

Appendix B. Time-to-Survive Model

We define time-to-survive (TTS) to be the longest time that the firm can last without losing demand after a disruption happens. TTS for the disruption scenario n can be calculated by solving the following linear program. This model is a special case of the TTR model in the sense that we can find the TTS of the network by solving a number of TTR models with different TTR values, and look for the smallest TTR value corresponding to the financial impact being strictly positive. This TTS formulation is more efficient because we can find the TTS by solving a single linear program.

$$\begin{array}{l}\text{Maximize}{t}^{(n)}\\ \text{s}\text{.t}\text{.}{u}_j-{\displaystyle \sum _{i\in {𝒫}_{jk}}{y}_{ij}}/r_{kj}\le 0,\forall k\in {𝒩}^{-}(j),\forall j\in 𝒟,\\ {\displaystyle \sum _{j\in {𝒩}^{+}(i)}{y}_{ij}}-u_i\le s_i,\forall i\in 𝒰& ,\\ u_j=0,\forall j\in {𝒮}^{,}\\ {\displaystyle \sum _{k\in V_j}{u}_k}\ge d_j{t}^{(n)},\forall j\in 𝒱,\\ {\displaystyle \sum _{k\in A_{\alpha }}{u}_k}\le c_{\alpha }{t}^{(n)},\forall \alpha \in 𝒜,\\ u_j,y_{ij},t^{(n)}\ge 0,\end{array}$$

where the constraints and variables are similar to the TTR models, except that (1) t⁽ⁿ⁾ is now a decision variable (TTS), and (2) we do not allow any loss (demand is strictly satisfied in the fourth constraint). The objective value of each optimization instance reveals the TTS of the underlying disruption scenario.