Magellan
TMS outage plan: control today’s loads and the return to service
Prepare a timestamped dispatch fallback, one temporary change log and a reconciliation plan for a TMS outage and recovery.
The office loses access to the dispatch system at 06:20. Three drivers need pickup instructions, one appointment changed overnight and billing cannot see which documents were approved. The software outage is now an operating problem because the company has not decided which information must remain available elsewhere.
A continuity plan should give the business a controlled way to make essential decisions while the system is unavailable. It should also explain when the business must pause. Working around an outage is useful only when the company can preserve safety, authorization and an accurate record of what happened.
List the decisions the next shift must make: who is assigned, what is confirmed, which equipment is available, which constraints apply and who may authorize a change. Rank the information needed for those decisions.
NIST's contingency-planning guidance (https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final) connects recovery priorities to the systems and operations being supported. The practical recommendation here is to identify a minimum operating picture before choosing a technical solution.
A backup can be valuable without being immediately usable by dispatch. A recovery image stored by an IT provider may restore a database later but tell a night dispatcher nothing about the current receiver appointment. Distinguish disaster recovery from the short-term information employees need to manage today's work.
Determine which current assignments, contacts, confirmed instructions and material exceptions must be available through an approved fallback. Limit sensitive information to what the role actually needs. Establish who creates the snapshot, how often and where authorized staff can retrieve it.
Record its creation time clearly. An old export that looks current can be worse than an obvious outage. Employees should know the age of the information and which changes may have occurred afterward.
Avoid making a personal laptop or private messaging account the business's unofficial continuity system. The fallback needs appropriate access controls, secure storage and a retention process. Convenience does not justify distributing driver records or commercial information through channels the company cannot manage.
Keep the duty coordinator and approved support contact available outside the affected login. During the exercise, verify that the backup employee can retrieve them from the device and location they would actually use.
For each essential task, state the information and authority needed to proceed. If the company cannot establish a driver's current assignment or an equipment restriction, the plan should provide an escalation or pause rather than an invitation to guess.
Keep other systems distinct. A TMS outage does not automatically mean the ELD, customer portal or payment system has failed. Conversely, access to one of those systems does not prove that all required controls are available.
An ELD malfunction has its own applicable requirements and procedures, described in FMCSA's malfunction guidance (https://www.fmcsa.dot.gov/regulations/hours-service/elds/eld-malfunctions-and-data-diagnostic-events-faqs). A paper dispatch list is not a substitute for whatever regulated recordkeeping method applies. Continuity planning should preserve those boundaries instead of treating every software problem as permission to use the same workaround.
When authorized work continues, record changes in one controlled log with an event time, assignment reference, change, source and responsible employee. Identify which instructions were confirmed and which remain pending.
Prevent competing temporary lists. If three dispatchers each record changes in separate notes, the recovery team will struggle to establish the latest decision. Choose a coordinator and explain how responsibility passes to another employee.
Use temporary identifiers carefully. New work created during the outage should not later collide with an existing load number or produce duplicate billing. Establish how the business recognizes those entries and who reconciles them. The continuity process needs an ending as well as a beginning.
Imagine the office has a timestamped snapshot of active loads from 05:45. At 06:20 the TMS becomes unavailable. One appointment change was confirmed at 06:00, so the snapshot alone does not contain the latest instruction.
The coordinator records that change in the temporary log, identifies its supporting communication and confirms what the driver has been told. Other dispatchers check the log before issuing new instructions. A new assignment that cannot be properly verified is escalated rather than released on assumptions.
When access returns, the company has a defined set of changes to reconcile. It does not have to rebuild the morning from everyone's memory. The example also shows why the fallback's timestamp matters: a snapshot is a starting point, not a guarantee of current truth.
Topics
- TMS
- Business continuity
- TMS downtime
- Recovery