Substitution Drill¶
Rehearsal / failover drill — instantiates Dependency Concentration Control
A rehearsed, live cutover from an overweight provider to its alternatives under realistic load and timing, proving a diversification that looks good on paper actually holds when exercised.
Substitution Drill is the step that puts a paper alternative to the test. Not "can we move?" (a checklist answers that) or "how concentrated are we?" (a metric answers that), but does the switch actually survive contact with real load and real clocks? Its defining move is to shift genuine production demand onto the alternative under realistic timing, because standby capacity that has never carried live load is not capacity — it is a hope with a contract attached. Where a stress test injects a failure and watches the damage, the drill deliberately executes the escape and measures whether the alternatives absorb it, whether the reserve holds, and whether the firebreaks contain any shortfall.
Example¶
A hospital pharmacy sources ≈90% of a critical sedation drug from one distributor; a secondary is "under contract" and assumed ready. The drill routes real daily demand to the secondary for a planned 72-hour window. It surfaces exactly what the contract paperwork hid: the secondary's cold-chain lead time is about two days rather than same-day, and its allocation cap sits below the hospital's peak-day need — so the firebreak, segmenting ICU supply from general-ward supply, is what keeps a shortfall from spreading beyond one unit. The reserve and the segmentation are re-sized on that evidence, and a paper "second source" finally becomes a real one — before an actual outage forced the discovery.
How it works¶
- Pick the overweight dependency and a real destination. The drill targets the fat node the measures flagged, moving to a specific named alternative.
- Shift genuine load under production timing. Real demand, real clocks — synthetic traffic on a quiet weekend proves nothing about a peak-hour cutover.
- Exercise the reserve. Put the standby capacity under load to learn its true ceiling and ramp time, not its brochure figure.
- Test the firebreak. Confirm segmentation actually contains a shortfall to one segment rather than letting it cascade, and capture recovery time and every gap that appears.
Tuning parameters¶
- Realism level — tabletop → shadow/parallel run → full live cutover; more realism yields more truth and more risk.
- Load fraction and duration — a thin slice for an hour vs. full volume for days; only the latter exposes capacity ceilings.
- Scope — a single firebreak-bounded segment vs. the whole system; bounding limits the blast radius of the drill itself.
- Notice — announced vs. surprise; surprise measures true readiness but raises the odds the drill causes an incident.
- Cadence — one-off vs. recurring; only recurrence keeps standby warm and skills current.
When it helps, and when it misleads¶
Its strength is that it converts an assumed alternative into a proven one and calibrates the reserve and firebreak to reality — it is the only mechanism here that can catch "the second source cannot actually take the load in time," which is precisely the failure that surfaces at the worst possible moment otherwise.[1]
Its failure modes are sharp. A drill run under gentle conditions certifies a switch that will collapse under real stress, and a too-easy drill is worse than none because it manufactures false assurance. Drills also carry genuine risk — a live cutover can cause the outage it rehearses — which is the excuse by which the most critical dependencies get their drills skipped as "too disruptive." The discipline is to make the drill as real as you dare, bound it inside a firebreak so a bad run is survivable, and repeat it so both the standby and the muscle memory stay warm.
How it implements the components¶
Substitution Drill fills the does-it-actually-hold side of the machinery:
shadow_capacity_reserve— the drill puts standby/reserve capacity under real load, revealing its true ceiling and ramp; idle reserve is unproven until drilled.segmentation_or_firebreak_boundary— it exercises the isolation boundaries that must contain a shortfall when load shifts, proving the firebreak holds instead of assuming it.
It does not decide the intended allocation (load_rebalancing_plan, tiered_provider_portfolio) — that is the Provider Load Split Table — nor certify paper movability (substitution_feasibility_map, portable_interface_requirement), which is the Portability Checklist; the drill proves, under load, what those two plan and promise.
Related¶
- Instantiates: Dependency Concentration Control — it is the live proof that a diversification is real rather than nominal.
- Consumes: Provider Load Split Table supplies the allocation the drill executes, and the Portability Checklist supplies the movability it validates.
- Sibling mechanisms: Portability Checklist · Provider Load Split Table · Dependency Concentration Stress Test · Multi-Sourcing Rule · Top-K Exposure Share · Weighted Dependency Graph · Effective Independent Provider Count · Dependency Concentration Heatmap · Common-Mode Dependency Audit · Concentration Cap Policy · Residual Concentration Risk Register
Editorial Notes¶
Form Classification¶
Form family: Experiment, Test & Rehearsal
Rationale: Substitution Drill operates as an active test, trial, simulation, drill, or rehearsal that generates evidence through a deliberate attempt or perturbation because it a rehearsed, live cutover from an overweight provider to its alternatives under realistic load and timing, proving a diversification that looks good on paper actually holds when exercised.
Independent corroboration: The frozen evidence defines Substitution Drill as 'A rehearsed, live cutover from an overweight provider to its alternatives under realistic load and timing, proving a diversification that looks good on paper actually holds when exercised', so its operative form is Experiment, Test & Rehearsal.
Nearest alternative: Communication, Facilitation & Learning — Substitution Drill includes features of a designed message, facilitated interaction, ritual, or learning activity that changes shared understanding, but its defining operation is an active test, trial, simulation, drill, or rehearsal that generates evidence through a deliberate attempt or perturbation.
Review outcome: Independent reviewer agreement; medium confidence.
Origin Attribution¶
Primary origin: Logistics & Supply Chain Management
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Universal
Rationale: Live supplier cutovers descend from continuity exercises that test alternate sourcing under realistic loads.
Related originating lineages:
- Disaster Management & Risk Reduction — Exercises verify continuity plans before emergencies.
- Engineering & Design — Operational qualification tests capacity and interface fit.
- Operations Research — Operations research, optimization, and queueing analysis supplies a parallel or contributing lineage for the mechanism's defining operation: a rehearsed, live cutover from an overweight provider to its alternatives under realistic load and timing, proving a diversification that looks good on paper actually holds when….
- Organizational & Management Science — Organizational design, management, and operational governance supplies a parallel or contributing lineage for the mechanism's defining operation: a rehearsed, live cutover from an overweight provider to its alternatives under realistic load and timing, proving a diversification that looks good on paper actually holds when….
Review resolution: The blind reviewers agree that logistics_supply_chain is the primary origin and differ only on alternate origin disagreement, origin mode disagreement, domain reach disagreement, encyclopedia synthesis disagreement. I preserve every independently explained alternate from both records rather than imposing a numeric cap. I retain cross_disciplinary_synthesis because the combined evidence shows material contributions from several lineages. The broader reach of universal records portability separately from historical provenance; encyclopedia_synthesis=true preserves the affirmative synthesis judgment where either reviewer identified one.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
The drill and the Dependency Concentration Stress Test are complements pointed in opposite directions: the stress test breaks a provider to measure the damage its loss would do; the drill moves off a provider to prove the escape route works. One quantifies exposure, the other validates the remedy — running only the first can leave a well-measured risk with an unproven fix.
References¶
[1] Basiri, A., Behnam, N., de Rooij, R., Hochstein, L., Kosewski, L., Reynolds, J., & Rosenthal, C. "Chaos Engineering". IEEE Software 33(3), 35-41 (2016). Basiri and colleagues describe controlled failure experiments as a way to replace assumption with empirical confidence about system behavior. registry ↩