Coverage Models for a Small Team: Who Carries the Phone, and When

Tuesday, 16:40, at Redbrook Engineering. Tomasz runs a desk of three and has just finished the ninety-day read from the previous article. The count was clear: the design office's overnight render jobs fail about twice a month. When they fail, the morning shift of eleven engineers has nothing to work on until someone restarts the queue. The business has a stopped-work need, so there will be a phone. On the whiteboard he has written three names, A, B and C, and the word "weeks". That is as far as it has got. Asha, who is B, asks the question that stops it there: "If it's my week and I'm in the shower, who answers?" Ben, who is C, asks the second one: "And if it's my week and it rings every night, do I just not sleep?" Both are the right question. Neither is answered by three letters and a word.

A coverage model is the rule that says who can be reached outside the desk's hours, by what route, and for what kind of problem. It also says who stands behind them if they cannot answer. It is the shape of the after-hours promise, drawn before anyone's name goes on it, and the shape determines most of the load a person will carry. This article is part of our After-Hours & On-Call Support series. It assumes the question in Do You Need After-Hours Cover at All? has been answered with "yes, something". That something now needs a shape.

It covers what a coverage model decides, then the simple rota, the primary and secondary pair, and the escalation-only model. Next comes the monitoring-driven model, which is really an overlay on the other three. The article explains why follow-the-sun is not available to three people and what to borrow from it anyway. Next comes the load each model puts on a person, worked through in hours. It finishes with a short war story and the coverage model comparison to copy, in that order.

What a Coverage Model Decides

Every coverage model answers the same four questions, and a model that leaves one unanswered is a model with a hole in it. Who holds the phone, and for how long at a stretch? What reaches the phone: everything anyone raises, only work that has stopped, or only what a monitor sees? Who answers when the holder cannot, and how long before the backup is tried? And what does the model cost the person holding it, counted in evenings, nights and weekends they cannot plan around? The first three are design. The fourth is the one people forget until someone resigns.

The clearest way to see a model is to draw it as a week grid: seven columns for the days, one row per week. Each cell has a colour for who carries the phone that day's evening and night. Three weeks of grid is enough to show a three-person rotation going round once. Drawn this way, the differences between the models are visible before anyone has argued about them. So is the load, because you can count the coloured cells with a person's name on them. The picture further down draws three models for a three-person desk. The rest of this article explains each one and what the cells cost.

Two things are not decided by the model and belong elsewhere. How often a person's turn comes round, how swaps work and who is never on call alone are rota rules, in The On-Call Rota People Accept. What the phone is for, in the sense of which problems justify waking a person, is a definition, in What Counts as an After-Hours Call. This article is the shape. The shape decides most of the cost, so it goes first.

The Simple Rota

The simple rota is one person, one phone, one whole week, then the next person. Everything that comes in outside hours reaches whoever holds the phone, and there is nobody behind them. For a three-person desk each person is on call one week in three. That sounds like a third of the year because it is a third of the year. Drawn as a grid, it is three solid rows: A all week, B all week, C all week, then A again.

Its virtue is that it is simple enough to run without a tool, a meeting or a dispute. The rota is a list of weeks with a name beside each, the phone passes on Monday morning, and everyone knows whose it is. For a desk of four or more people, with a night that rings rarely, it is often the right model and it stays right for years. I ran one for a desk of five where the phone rang perhaps once a month, and the hardest part was remembering to charge it.

Its flaw is the shower. The simple rota has no answer to the holder being unreachable. That happens for ordinary reasons: a signal dead spot, a bath, a child's school play, a phone left in a coat. In a quiet week this is survivable, because the probability that the one call lands in the one hour of unreachability is small. In a loud week it is not. The loud week is also the week in which the holder is most tired, least patient and most likely to be in the bath on purpose. The simple rota also has no answer to a problem that needs two people, which some incidents do. It has no answer to the holder falling ill mid-week except an unplanned swap. With three people, one week in three with no backup is a model that asks a lot and offers nothing behind it. A rota of one is not a rota. It is a person with a phone and a grievance.

The Primary and Secondary Pair

The primary and secondary pair gives every week two names. There is a primary, who answers first, and a secondary, who is tried when the primary has not responded within an agreed time. That time is usually somewhere between ten and twenty minutes. The pair rotates so that this week's secondary is next week's primary. For three people, each person is primary one week in three and secondary one week in three. That means on the rota two weeks in three, but never alone. Drawn as a grid, each cell is split: the top half is the primary's colour, the bottom half the secondary's.

The secondary carries a lighter promise than the primary. And the lightness has to be written down or it becomes a second full on-call week. A secondary can be at dinner, at the cinema with the phone on vibrate, or asleep with the phone by the bed. A secondary cannot be abroad, out of signal, or past the point of being able to drive. The secondary's phone rings rarely, in a well-run pair perhaps one call in six, and that rarity is what makes two weeks in three bearable. If the secondary is ringing as often as the primary, the primary is not answering, and that is a conversation rather than a model problem.

The pair also answers the question the simple rota cannot, which is what happens when the night needs two people. A major incident, in the sense of Coordinating a Major Incident With Two People, needs one person fixing and one person communicating. The pair gives you both by design: the primary calls the secondary in and the roles are already understood. For a desk of three to six people, with a night that sometimes rings twice, the pair is usually the right model. It costs more weeks per person than the simple rota and far fewer bad ones. Asha's shower question has an answer, and the answer is Ben, who was going to be awake anyway.

The Escalation-Only Model

The escalation-only model has no rota at all. One number is published. It reaches the desk lead or a senior pair who alternate by the month. And it is for work that has stopped and nothing else. Nobody carries a phone in the sense of planning their week around it. The lead keeps their own phone on, as leads tend to. The number rings a handful of times a quarter because the definition of what it is for is narrow and published. Drawn as a grid, the cells are empty, because there is no colour to put in them. The grid is the point: it shows what the model does not ask.

This is the right model for a desk of two or three in a business that mostly sleeps. And it is the model the previous article's count most often points to. It costs nothing in rota weeks, and it costs one thing instead, which is discipline about the definition. The number works only if it is used for stopped work. The first time it is used for a password at eleven at night and the lead answers it kindly, it has become a help line. And a help line with one number and one person behind it is a one-person simple rota that nobody agreed to. The definition and the way it is published are in the article on what counts. For the model, it is enough that the definition exists, is one sentence long, and is printed next to the number everywhere the number appears.

The second risk is that "the lead" quietly becomes "the lead, permanently". The alternation has to be real, with a second senior person taking the number for alternate months. And the lead has to actually hand it over rather than keeping it "just in case". A lead who holds the number for three years has done the simple rota alone for three years, and will have the record of a person who did. The alternation goes on the coverage calendar like any other rota, which is what The Coverage Calendar and the Single Point of Failure is for.

The picture below draws these three models side by side for a three-person desk, three weeks each. Read the grids first, then the two lines under each: the load the model puts on one person, and the team it suits. The simple rota's cells are solid; the pair's are split between primary and secondary. The escalation-only grid has no colour, because nobody holds a phone by the week. The legend at the foot explains the colours.

The Monitoring-Driven Model

The monitoring-driven model changes what reaches the phone rather than who holds it. In the three models above, the phone is rung by people: a shift supervisor, a manager, an engineer who arrived at seven. In the monitoring-driven model the monitor is the main caller. A check on a service fails, the failure becomes a ticket, and the ticket reaches whoever holds the phone by the route the desk has agreed. People can still ring, but the night's work mostly arrives from a machine that has read the symptoms already. For a business whose after-hours need is a service rather than a shift, this is the model that makes the phone useful. That was the case with Redbrook's render queue. The person is woken for a thing that has actually failed, with the name of the thing in the ticket. They are not woken for a person's guess about it.

It is an overlay, not a fourth shape. You still choose a simple rota, a pair or a single number for the people side. Then decide, service by service, which failures reach that phone at night and which wait as the morning's first ticket. The mechanics of turning a check into a ticket are in Opening Tickets From Alerts: The Mechanics, and they matter less than the decision. An alert can open an ordinary ticket through the API in QuerySolv and in most help desk tools. That ticket lands in the same queue the morning desk reads, with its history intact. So the night's events and the day's are one record rather than two.

The overlay's failure mode is volume. A monitor that raises a flag for every blip will wake the phone holder for things that fix themselves. After the third pointless night the holder starts ignoring the phone, which is the worst state a coverage model can reach. The night list must be short. It should include the services that stop work, the checks that mean it, and nothing that clears on its own within a few minutes. Avoiding Alert-Ticket Floods is the discipline, and it applies with twice the force at two in the morning. A monitor that cries at every shadow is a colleague nobody wants on the rota.

Why Follow-the-Sun Is Not Available to Three People

Follow-the-sun is a coverage model in which three or more teams in different time zones each work their own daytime. Between them, they cover the clock. So nobody is ever on call at night because it is always someone's afternoon. It is a lovely idea and it works, for organisations with a full desk in three places. A three-person desk in one building does not have three places. It has one, and the sun leaves it at the same time every evening.

The reason it cannot be faked is that each team in a follow-the-sun arrangement is a whole desk. It has the access, the knowledge and the numbers to do the job unaided. Three people cannot be three desks. A single remote colleague in another time zone is not a team. They are one person, who also sleeps and has holidays. They cannot be the only person awake for eight hours of every day without becoming the simple rota in a different country. Vendors describe follow-the-sun warmly to companies with one office. The warmth is sincere, and so is the one office.

What a small desk can borrow from it is an hour or two at the edges. Suppose the organisation has a colleague, a sister office or a managed partner working in a time zone a few hours ahead. Their ordinary morning can cover your early start, and your late afternoon can cover their evening, with no night work for anyone. The arrangement has to be explicit, with the hours, the route and what counts written down on both sides. And the details of running a desk across zones are in Time Zones, Coverage and the Remote Worker's Day. The arrangement shaves the ends off the night. It does not remove the middle, and the middle is where the render queue fails.

The Load Each Model Puts on a Person

The load is the number people forget to count before they pick a model. And it is countable, so count it, in hours a person is reachable rather than in money. Take a desk of three and a published day of 08:00 to 18:00 on weekdays. Outside those hours is fourteen hours a weeknight, five nights, plus the whole weekend: roughly 118 hours a week in which someone has to be reachable. A simple rota puts those 118 hours on one person for about seventeen weeks a year. That is about two thousand hours a year of "cannot be out of signal", before a single call has arrived. The call hours are on top. The small print of the call hours, the time back and the protected morning, is the subject of Compensation and Recovery Time.

The pair spreads the same hours differently. Each person is primary for seventeen weeks and secondary for seventeen, so they are on the rota for thirty-four weeks a year. But a secondary week is a lighter promise, perhaps a fifth of the restriction of a primary one. Call it seventeen heavy weeks and seventeen light ones, against the simple rota's seventeen heavy weeks and no backup. The pair costs more weeks and buys a backup, a second person for an incident, and an answer to the shower. Most three-person desks that have run both prefer the pair. And the ones that prefer the simple rota usually have a phone that almost never rings.

The escalation-only model's load is a different kind. Nobody is on a rota, so no week is heavy, and the number holder's restriction is close to the one a lead already lives with. The load is the handful of calls a quarter, each of which lands on a senior person, plus the alternation. Where the count from the previous article is small, this is by far the lightest model in hours. Where the count grows, the escalation-only model becomes a simple rota of two without anyone noticing, and the first sign is the lead's spouse.

Now subtract leave. Three people with five weeks' leave each means that for fifteen weeks of the year one of the three is away. During those weeks, the simple rota becomes one week in two for the other two. The pair becomes primary one week in two and secondary the other, which is every week. This is the arithmetic that makes the simple rota and the pair hard to sustain below four people. And it should be done out loud before the model is chosen, because the people doing it are the people who will live in it. A model that looks like one week in three on the whiteboard and feels like one week in two in August is a model that was drawn without a calendar.

Choosing: The Coverage Model Comparison

The table below is the comparison, laid out so a desk can pick a row and copy it into the on-call agreement. Read it against your count from the need assessment and your headcount. And let those two numbers choose the row rather than the model's description. The "fails when" column is the one to read twice, because every model fails in a characteristic way. The way it fails is the thing you will be explaining in a year.

Before the row is copied, run the checklist. It is short because the hard thinking was the count; the checklist only makes sure the model matches it.

• The after-hours need assessment is done and the count is written on the model.
• The headcount used for the load is the headcount after leave, not the number on the org chart.
• The backup is a name on a calendar, not a hope.
• The definition of what reaches the phone is one sentence and is published beside the number.
• Each service on the monitor's night list has a written yes or no to "wake someone for this".
• The model's "fails when" has been read aloud to the people who will carry the phone.
• The compensation and recovery principles are agreed before the first week, not after the first bad night.

Tomasz chose the pair with the monitoring overlay. Redbrook's render queue got a check and a yes beside "wake someone for this"; the file service got a check and a no. The whiteboard got six names across three weeks, the ninety-day count written in the corner, and a line under the grid saying what the phone was for. Asha asked what happens if she is in the shower, and Tomasz pointed at Ben's name in the bottom half of her week. Ben asked what happens if it rings every night. That question belongs to the next article, because a model decides the shape of the week and a rota decides whether people will accept living in it.

A Short War Story: The Secondary Who Was a Hope at Bellweather Logistics

Bellweather Logistics ran a primary and secondary pair for its depot systems, on paper. The secondary slot was filled each week by the phrase "whoever is around". The desk lead did not want to put a second name on every week of a three-person rota. In practice the secondary was Marco, who lived nearest the depot and was generous. He answered the secondary role for fourteen months without it ever being written down. In the fifteenth month Marco went abroad for two weeks. The primary that week, Nadia, lost her phone signal on a Friday night in a village with one bar. The depot's label printing stopped at 23:10 with the Saturday trunk loads half built. The night supervisor rang the number eleven times, then rang Marco's personal mobile, which was switched off in another country. The depot ran on handwritten labels until Nadia drove into signal at 02:30 and restarted the print service in four minutes. The lead's review put the cost at three hours of a twelve-person shift and a morning of wrong-labelled pallets. It put the fix at one line. Every week on the rota has two names, and the second one is a person, not a hope.

The model was fine; the calendar was the problem. And a calendar with a blank secondary column is not a pair, whatever the agreement says. Bellweather's rota has had two names on every week since, and the secondary rings about one call in seven, which is what the model promised all along.

Frequently Asked Questions