Recoverable robustness in shunting and timetabling