Every depot has clocking terminals on the wall by the drivers' room. Staff badge in and out, the times flow into our time and attendance system, and from there into payroll and the lateness rules. Arrive more than five minutes after the start of a shift and you get a lateness point. Three points in a quarter means a conversation with your manager, and for agency workers it can mean fewer shifts.
The terminals keep time by asking a time server in head office, once a day. In March we replaced the firewalls at our nine northern depots. The new rules were built from a month of traffic logs showing what each site actually used, and anything not on the list was blocked. The daily time request was a single small packet that the analysis never picked out, and the old firewalls had allowed it under a broad rule nobody had written down.
Nothing failed. The terminals carried on using their own internal clocks, which gain a few seconds a day. By August the terminals at our largest northern depot were seven minutes fast.
A driver who had just received his second lateness point photographed the terminal next to his phone and gave the picture to his union representative. When we checked, every terminal behind the new firewalls was between three and seven minutes out. HR withdrew forty one lateness points, and two agency drivers who had lost shifts were offered them back. The same minutes had been added to every clock out, and payroll had paid them as overtime for five months.
What struck me was how little the system needed in order to be wrong. Every terminal was healthy by every measure we monitored. None of our monitoring asked whether the time was right, because it had never occurred to anyone that it could be otherwise.
Time synchronisation is now a named service in the firewall standard, with its own rule, so it cannot disappear inside a broad one again. Every device that records times for pay or compliance reports its offset to our monitoring, and anything more than thirty seconds out raises an alert. Before HR issues a lateness point, the record now shows the terminal's offset on that morning.
A clock never reports that it is wrong. It keeps going, confidently, and everything that trusts it inherits the error.
– Serguey Shinder
Top comments (0)