05

Applying WIP constraints: cap the queue, cap the delay

Reducing utilization or batch size shrinks queues indirectly and slowly. A WIP constraint attacks the queue head-on: refuse to start new work while too much is already in process. By Little's Law that puts a ceiling on cycle time, and queueing math shows the ceiling costs only a sliver of throughput. Toyota's kanban and the Internet's window flow control are the two great working examples. The rest of the chapter is about what to do when WIP hits the limit — block, purge, shed scope, pull resources, change the mix — and how to watch WIP so you react early.

Push vs. pull: the same demand on two boards

W1W2W23
Three stages with random arrivals and random work times; Build is the bottleneck. Both boards receive exactly the same items. The push board starts everything; the pull board starts a new item only while total WIP is below its limit — excess demand waits uncommitted in the backlog.

Same demand, two boards

day 0
Push: start everything that arrivesWIP 0demand0admitted0held backAnalyze02 workersBuild03 workersTest02 workersdone0shipped
Pull: start new work only while WIP < 20WIP 0 / 20demand0admitted0held backAnalyze02 workersBuild03 workersTest02 workersdone0shipped
being worked waiting in queue done, blocked by next stageage:0 → 29+ days

WIP in the system (items)

push (no limit)pull (WIP ≤ 20)
050100150200250day

Cycle time, 30-day rolling (days)

pushpull
050100150200250day
cycle time · push
—
avg WIP 0.0
cycle time · pull
—
avg WIP 0.0
push is slower by
—
throughput · push
0.00/d
throughput · pull
0.00/d
demand held back
0.0%
waits in backlog

Build is the bottleneck: 3 workers × 1/3.0 d = 1.0 item/day, so λ is also its utilization. Try: run 300+ days at λ = 0.92, then slide λ past 1.0 — the push board's Build queue grows without bound while the pull board holds its WIP and simply admits less. Then tighten the limit to 10 and watch cycle time fall faster than throughput.

Where to set the limit, and why ratcheting works

W1W22
The exact M/M/1/K queue: a single server whose system holds at most K jobs. Compare the cycle time saved with the demand turned away, for every possible limit.

What a WIP limit buys and costs (M/M/1/K)

mean cycle time, % of unlimited95th-pct cycle time, % of unlimitedthroughput, % of demand
0%50%100%102030WIP limit K (items)K = 18avg unconstrained WIP
mean cycle time · no limit
10.0
in units of one job's service time
mean cycle time · K = 18
6.8
32% shorter
95th pct · no limit
30.0
95th pct · K = 18
17.4
42% shorter
demand blocked
1.7%
the throughput price
avg WIP
6.0 vs 9.0
Little: L = λ·W

Single server, random arrivals and service times; an arrival that finds K jobs in the system is held back (blocked). Try: at 90% utilization, a limit at 2× the average queue (K = 18) cuts mean cycle time about a third and the 95th percentile by more, for under 2% of demand. Then click Ratchet a few times and watch each small cut compound.

The asymmetry is the whole argument for W1: blocking happens only in rare high-queue states, which are exactly the states that create the longest cycle times. Cutting them off costs little throughput but removes the tail. W22 follows: because each small cut is cheap, ratchet the limit down step by step, fix whatever problem the tighter limit exposes, and let the cycle-time gains accumulate.

Global vs. local constraints: drum-buffer-rope, kanban and TCP

W3W4W5W21
A four-stage line runs smoothly until one stage nearly stops. A global constraint (Theory of Constraints' drum-buffer-rope) caps the work released up to the known bottleneck; local constraints cap every stage, so a jam pushes back hand-off by hand-off, as kanban cards and TCP's per-connection windows do.
What breaks at day 60?

Demand 0.85/day into Spec → Design → Build → Verify (Build is the designed bottleneck at 1.0/day). The broken stage runs at 10% capacity during the outage. Global rope: release new work only while Spec+Design+Build hold < 13. Local kanban: each stage holds at most workers + 2 (4, 4, 5, 4). Same items, same random draws for every policy.

Total WIP in the line

No limit (push)Global: drum-buffer-rope at BuildLocal: kanban limit per stage
Verify down010203050100150200day

Queue at Verify (items in that stage)

No limit (push)Global: drum-buffer-rope at BuildLocal: kanban limit per stage
0102050100150200day

Where the WIP sits when the outage ends

SpecDesignBuild (bottleneck)VerifyNo limit (push)20322Global20322Local4454
peak WIP · push
28
peak WIP · global
28
peak WIP · local
17
peak at Verify · push
27
0 held in backlog
peak at Verify · global
27
3 held in backlog
peak at Verify · local
4
23 held in backlog
stops intake · push
never
after outage start
stops intake · global
+67.5 d
after outage start
stops intake · local
+12.3 d
after outage start

Try: break Build — the global rope works fine, because it was tied to exactly that stage. Now break Verify: the rope keeps releasing work at Build's pace and the pile in front of Verify grows for the whole outage, while local kanban limits push back stage by stage within days.

W3 vs. W4. A global cap is simple and right for a factory with a stable bottleneck. Product development's bottleneck moves with the work, so local limits — which need no idea where the bottleneck is — are usually the better default. The Internet works the same way: no central controller, only local windows and local drops.
W5: use a range. If design releases drawings in batches of 5 and test consumes them 3 at a time, a single WIP number is always violated. A band (say, 3 to 8 between them) lets each side use its own economic batch while keeping the total bounded.
W21: constrain the costly queue. In every simulation here, blocked work waits in the uncommitted backlog, where waiting is cheap — nothing half-built is decaying and it can still be re-prioritized or cancelled. Put the tight limit where queueing costs the most.

The emergency playbook: what to do when WIP hits the limit

W6W7W8W9W10W11W12W13W14
A demand surge builds a queue in front of test, the bottleneck. When the queue crosses the alarm level, your chosen responses switch on; they switch off once it has drained to a third of the alarm level. Combine moves and compare against doing nothing on the same arrivals. Every move has a price — read it before you celebrate.

Queue waiting for test (items)

do nothingwith your responses
demand surge +110%01020050100dayalarm

Committed WIP vs. held-back demand (items)

committed · do nothingcommitted · responsesheld in backlog
0102030050100day
peak test queue
17 vs 25
cycle time once started
5.1 d
do nothing: 7.7 d
time from request
5.1 d
do nothing: 7.7 d
cost of delay
$1.6M
saves $729k
alarm on for
18 d
do nothing: 48 d

Price paid: 13.3 borrowed person-days. Dev (5 people) feeds Test (2 testers, the bottleneck at ~1.4 items/day); demand jumps from 1.0 to 2.1/day for 30 days. Cost of delay averages $2k per item per day, counted from the request; killed items are excluded (their value is gone instead). Try: Pull a tester with lag 1, then 12 — the same resource is worth far less late (W9). Then try Block alone: the committed queue shrinks but time-from-request barely moves — blocking only relocates the queue to where it is cheaper (W21).

Demand side (W6–W8). Blocking, purging and shedding reduce what enters or remains in the queue. Blocking only moves the wait outside; purging and shedding actually remove work, so decide in advance which projects and requirements are expendable.
Supply side (W9–W14). Add capacity at the bottleneck — fast. Part-time people, lightly-loaded experts and T-shaped, cross-trained neighbors are surge capacity you must build before the emergency. Mix change is free: the same work, resequenced so the bottleneck gets the light jobs while it is overloaded.

Watch the outliers: aging, escalation and expansion control

W15W16W20W23
Task effort in product development is heavy-tailed, and some tasks keep growing. Under a WIP limit, one runaway task does double damage: it is late itself and it holds a slot everyone else needs. Track the age of every card, escalate by rule, and box the effort a task may consume.

Board with escalation — red = older than 15 days

day 0
Kanban limits 4 / 5 / 4 · 0 of 0 cards past the aging limitWIP 0demand0admitted0held backDesign0/42 workersBuild0/53 workersTest0/42 workersdone0shipped

Cycle-time scatter: every finished item

01020300100200300finished on daycycle time (days)aging limit
gray = same items with no action · colored = escalation
median cycle time
0.0 d
no action: 0.0 d
95th percentile
0.0 d
no action: 0.0 d
worst item
0 d
no action: 0 d
past aging limit
0.0%
no action: 0.0%
throughput
0.00/d
no action: 0.00/d
demand held back
0
no action: 0

Task effort is heavy-tailed (lognormal, and 6% of tasks expand to 5× their size). Escalation: the 2 oldest items past the limit jump their queue and get an expert working 3× faster. Timebox: no task may consume more than the box in any stage — the rest is cut or deferred to a follow-up. Try: just watch for 200 days and note how a handful of expanders hold kanban slots hostage and block everyone behind them; then switch to escalation or a 2× timebox and compare the tail.

Differential service: give urgent work its own lane

W18
One team serves two classes of work: a small stream of expedites with 10× the cost of delay, and normal work. A single FIFO queue gives them identical service. Priority helps; a dedicated lane that may interrupt normal work, plus a WIP cap on the normal lane, gives each class the service its economics justify.

Expedite cycle time (mean / 95th pct, days)

One shared FIFO queue2.2 / 5.2Priority for expedites1.1 / 3.0Expedite lane + WIP cap0.9 / 2.8

Normal cycle time once admitted (mean / 95th pct, days)

One shared FIFO queue2.2 / 5.5Priority for expedites2.4 / 5.9Expedite lane + WIP cap2.0 / 4.7
expedites: lanes vs FIFO
2.3× faster
2.2 → 0.9 d
normal: lanes vs FIFO
2.0 d
2.6 d from request · FIFO 2.2
normal work held back
1.6
avg items in backlog, ~1.9 d wait
CoD-weighted delay from request
1.52 d
FIFO 2.19 · priority 1.59

4 people, each job takes 1 day on average (exponential); expedites carry 10× the cost of delay of normal work. The expedite lane lets an expedite interrupt normal work when everyone is busy (escalate the expedite) and caps normal work in process; normal work beyond the cap waits in the backlog, uncommitted. Interruption costs (context switching) are not modeled. Try: push utilization to 92% — the FIFO expedite waits as long as everything else, while the lane keeps it near its 1-day service time. Raise the expedite share to 40% and watch normal work pay for it: differential service only works while the fast lane is a small fraction of the flow. Lower the WIP cap to bound normal cycle time and see the backlog grow instead.

Lessons from the Internet: congestion collapse, throttling and adaptive windows

W17W19
The Internet runs at high utilization with highly variable traffic and no central control — and it nearly died of congestion in 1986. Its fixes are WIP constraints: limit what is in flight, throttle progressively as queues rise, and adapt the limit to the capacity actually available.

Goodput: useful messages delivered, % of capacity

no WIP limit (unbounded queue)hard limit: drop at 100progressive throttling from 20
0%50%100%0.511.52offered load (× capacity)

Delay per delivered message (ticks, incl. retransmissions)

no WIP limit (unbounded queue)hard limit: drop at 100progressive throttling from 20
0102030400.511.52offered load (× capacity)
goodput · no limit
15%
85% of work spent on duplicates
goodput · hard limit
100%
delay 11.2 ticks
goodput · throttling
100%
delay 2.9 ticks
demand throttled
17%
queue ≈ 28 vs 90

A router serves 10 messages per tick. A sender that hears nothing within 20 ticks sends the message again; duplicates still sitting in the queue use capacity when served. With no limit, once the queue's wait exceeds the timeout, a growing share of the router's work is duplicates — goodput collapses just past 100% load, the Internet's 1986 congestion collapse. The hard limit drops arrivals at a full buffer; progressive throttling turns away a growing share of new demand as the queue rises, so the queue stays short. Try: slide the load from 95% to 105% and watch the red curve fall off a cliff.

Adaptive WIP: TCP's window tracks a changing capacity

link capacity (pipe)capacity + 40-pkt bufferfixed WIP limitAIMD window (+1 per RTT, ÷2 on loss)
capacity dips050100050100150200250time (round trips)packets in flight (WIP)
during dip · fixed
4.3 RTT
8.0 pkts lost per RTT
during dip · AIMD
3.3 RTT
0.22 pkts lost per RTT
after upgrade · fixed
75% used
capacity left idle
after upgrade · AIMD
81% used
window grows into it

TCP's window is a WIP limit on unacknowledged packets; by Little's Law throughput = window ÷ round-trip time. Capacity is 40, drops to 12, then rises to 80 packets per round trip. A fixed limit that was right before the change is too high during the dip (a standing queue and steady losses) and too low after the upgrade (idle capacity). AIMD probes upward slowly and halves at the first loss, so it keeps re-finding the right WIP. Try: deepen the dip to 5 and compare the delay of the two policies.

  • takeawayCap WIP and you cap cycle time (Little's Law). A limit near twice the average queue removes the worst delays for a percent or two of throughput — then ratchet it down.
  • takeawayPrefer local limits at each hand-off: they push back within days wherever the jam appears, without knowing where the bottleneck is. Hold excess demand where waiting is cheapest.
  • takeawayPlan the response before the queue arrives: who gets pulled in, which scope is expendable, what gets purged, how aged items escalate — and throttle progressively rather than slamming the door.

All 23 principles of applying wip constraints

book chapter 6
  1. W1
    The Principle of WIP Constraints

    Limit the amount of work-in-process to control cycle time and flow.

    By Little's Law, cycle time is WIP divided by throughput, so capping WIP caps the average cycle time. Queueing math shows the price is small: a limit at about twice the average unconstrained queue cuts the worst queues and the long cycle times while rejecting only a percent or two of demand.

    ↑ see it in the visualization
  2. W2
    The Principle of Rate-Matching

    WIP constraints force the rate of starting work to match the rate of finishing it.

    When a downstream stage is full, upstream cannot push more into it, so the system admits work only as fast as it completes work. Without the constraint, a fast upstream stage keeps feeding a slower one and the difference silently becomes a queue.

    ↑ see it in the visualization
  3. W3
    The Principle of Global Constraints

    Use a global constraint on total WIP when the bottleneck is predictable and permanent.

    Theory of Constraints' drum-buffer-rope releases new work only as the bottleneck finishes it, capping the whole line's WIP with one simple rule. It works well in a factory with a stable bottleneck; in product development the bottleneck moves with the work mix, so a single global cap reacts slowly.

    ↑ see it in the visualization
  4. W4
    The Principle of Local Constraints

    Where you can, constrain the WIP of each local pool instead of only the total.

    A kanban limit at every hand-off (like TCP's window at every connection) stops the stage just upstream of a jam within one item, and the back-pressure propagates step by step. Local limits react faster and need no knowledge of where the bottleneck currently is.

    ↑ see it in the visualization
  5. W5
    The Batch Size Decoupling Principle

    Use a WIP range, not a single number, to decouple the batch sizes of adjacent processes.

    If design hands work over in batches of five and test consumes them in batches of three, a fixed WIP target can never be met exactly. Let WIP float between an upper and lower bound so each process can use its own economic batch size while the total stays controlled.

    ↑ see it in the visualization
  6. W6
    The Principle of Demand Blocking

    When WIP reaches its upper limit, block all new demand until it falls.

    The blocked work does not vanish; it waits outside the system in a cheap, uncommitted state (a backlog nobody has started, a request not yet accepted). This is the simplest response and the one a kanban card or a full TCP window applies automatically.

    ↑ see it in the visualization
  7. W7
    The Principle of WIP Purging

    When WIP is too high, kill the lowest-value work in process.

    Money already spent is a sunk cost; the question is whether the remaining work is worth its remaining cost plus the delay it imposes on everything behind it. A queue crisis is the moment to cancel the marginal projects that should have been cancelled anyway.

    ↑ see it in the visualization
  8. W8
    The Principle of Flexible Requirements

    Reduce WIP by shedding non-essential requirements when the queue is high.

    Cutting a feature from every item in the queue reduces the work content of the whole queue at once. Decide in advance which requirements are expendable so you can drop them quickly, the way a release train drops the stories that don't make the cut.

    ↑ see it in the visualization
  9. W9
    The Principle of Resource Pulling

    Apply extra resources to an emerging queue quickly, while it is still small.

    Queues grow and drain asymmetrically: a little extra capacity early prevents a big queue, while the same capacity added late needs a long time to drain it. Speed of response matters more than the size of the response.

    ↑ see it in the visualization
  10. W10
    The Principle of Part-Time Resources

    Use part-time resources on high-variability work so they can surge when a queue forms.

    Someone loaded at 50% on a project can jump to 100% the day a queue appears, with no ramp-up because they already know the work. A full-time person already at 100% has no surge capacity at all.

    ↑ see it in the visualization
  11. W11
    The Big Gun Principle

    Pull high-powered experts onto emerging bottlenecks.

    A senior expert can clear in days a problem that would take a team weeks, so keep your best people lightly loaded and on call for queue emergencies rather than buried in routine work they would be fully utilized by.

    ↑ see it in the visualization
  12. W12
    The Principle of T-Shaped Resources

    Develop people who are deep in one specialty and broad across many.

    A T-shaped engineer adds value on their own specialty and can still help usefully wherever a queue appears. Pure specialists are efficient but cannot move; pure generalists move but lack depth.

    ↑ see it in the visualization
  13. W13
    The Principle of Skill Overlap

    Cross-train people at adjacent processes so they can absorb each other's queues.

    The most useful overlap is with the stage next door: a developer who can write and run tests can help when the test queue grows, and the hand-off between them gets better too.

    ↑ see it in the visualization
  14. W14
    The Mix Change Principle

    Change the mix of work released upstream to regulate the queue at a bottleneck.

    When the test queue is high, start the jobs that need little testing and hold the test-heavy ones; when it is low, do the reverse. The total work is unchanged, but the bottleneck's load is smoothed by sequencing upstream work.

    ↑ see it in the visualization
  15. W15
    The Aging Principle

    Watch the age of items in WIP; the outliers carry the problem.

    An average cycle time hides the few jobs that are stuck. Tracking the age of every item in process exposes them early, because an item that has been in a stage far longer than usual is almost always blocked, not just slow.

    ↑ see it in the visualization
  16. W16
    The Escalation Principle

    Have a pre-planned escalation process for items that exceed an age limit.

    Decide in advance who gets told and what happens (more people, an expert, a decision from management) when a job crosses the aging threshold, so the response is automatic instead of negotiated each time.

    ↑ see it in the visualization
  17. W17
    The Principle of Progressive Throttling

    Throttle demand gradually as the queue approaches its limit instead of slamming it shut at the limit.

    Internet routers using random early detection drop a growing fraction of packets as the queue rises, so senders slow down before the buffer fills. Gradual throttling avoids the oscillation of on/off blocking and keeps the queue short.

    ↑ see it in the visualization
  18. W18
    The Principle of Differential Service

    Give different classes of work different WIP limits and priorities according to their cost of delay.

    A single queue treats a high-cost-of-delay expedite like routine work. Separate workstreams with their own WIP constraints and priority give fast service to the urgent class, as Internet DiffServ does for voice versus email traffic.

    ↑ see it in the visualization
  19. W19
    The Principle of Adaptive WIP Constraints

    Adjust WIP constraints as the capacity of the system changes.

    TCP grows its window slowly while things flow and cuts it sharply at the first sign of congestion, constantly tracking the capacity it can actually get. A fixed WIP limit set for last quarter's team is too high when people leave and too low when they join.

    ↑ see it in the visualization
  20. W20
    The Expansion Control Principle

    Prevent individual work items from expanding without limit.

    Some tasks grow the longer you work on them: research that never converges, a refactor that keeps finding more. Under a WIP limit an expanding task also holds a slot hostage, so set a time or effort box and force a decision when it is reached.

    ↑ see it in the visualization
  21. W21
    The Principle of the Critical Queue

    Constrain WIP in the part of the system where queueing is most expensive.

    Not all queues cost the same: a queue of committed, half-built work ties up money and decays, while a queue of unstarted ideas costs little. Hold excess demand where it is cheapest and keep the expensive queue short.

    ↑ see it in the visualization
  22. W22
    The Cumulative Reduction Principle

    Small, repeated reductions in WIP add up to large reductions in cycle time.

    Ratchet the WIP limit down a little at a time, fix whatever problem the tighter limit exposes, then ratchet again. Each step is cheap and the effects on cycle time compound, much like reducing inventory to expose the rocks in lean manufacturing.

    ↑ see it in the visualization
  23. W23
    The Principle of Visual WIP

    Make WIP continuously visible to everyone.

    Product development inventory is invisible information, so represent each item as a physical or digital card on a board. Once people can see the pile in front of a stage, they self-organize to clear it.

    ↑ see it in the visualization