Shift handover in a control room

Shift handover transfers responsibility for a running plant between people, and it is the point at which context is most likely to be lost. Investigation reports into process incidents repeatedly identify inadequate handover as a contributing factor, usually in the form of a condition known to one shift and not communicated to the next.

What has to transfer

• Current plant state, and anything that is not normal.
• Work in progress: what is being done, by whom, and what state it is in.
• Equipment out of service, and whether alarms associated with it are suppressed.
• Anything currently bypassed, shelved, forced or overridden, with the reason.
• Recent events and how they were handled.
• Expected activities during the coming shift.
• Anything being watched: a condition that is not yet a problem but might become one.

The fourth item is the one most consequential and most often omitted. A bypass applied by one shift and unknown to the next is a removed safeguard that nobody knows is removed.

Written and verbal, not one or the other

A verbal handover conveys nuance and emphasis and leaves no record. A written log provides a record and loses the emphasis.

Both together work: the outgoing operator prepares a written summary, the two discuss it face to face with the plant displays available, and the incoming operator confirms understanding. The discussion is where the incoming operator asks the questions the log did not anticipate.

Structure prevents omission

An unstructured handover covers what the outgoing operator happens to remember, which under fatigue at the end of a twelve-hour shift is not everything.

A standard format — the same headings every time, corresponding to the list above — turns recall into a checklist. It also makes the log readable later, which matters during investigations.

System-generated content

Some handover content can be produced automatically rather than remembered: currently shelved alarms, active overrides, equipment in maintenance state, alarms standing beyond a threshold, and the alarm count for the shift.

Generating that automatically as part of the handover document removes the most safety-relevant items from the category of things someone has to remember.

Time and overlap

Handover conducted while the outgoing operator is collecting their belongings is not a handover. It needs allocated time with both parties present and attentive.

A short paid overlap is the mechanism, and it is one of the more cost-effective safety measures available in a control room. Where the overlap is squeezed for cost reasons, the saving is small and the exposure recurs twice a day.

Handover during abnormal conditions

The highest-risk handover is one occurring during an ongoing upset, when the outgoing operator has the most context and the least time to convey it.

Some sites hold the outgoing operator through the resolution of an active event rather than handing over mid-incident. Where that is not practical, an extended handover with the supervisor present is the alternative.

What does not work is a normal-length handover during an abnormal situation.

Reviewing the logs

Shift logs are written and rarely read. Periodic review by a supervisor or engineer serves two purposes: it identifies recurring issues that individual shifts have been working around, and it provides feedback on handover quality.

The recurring-issue finding is frequently the more valuable. A problem noted in the log on twelve consecutive shifts, each time handled by the operator on duty, has never been reported as a problem because each individual instance was managed.

Handover between operations and maintenance

Control room handover is one boundary. Others matter equally: between operations and maintenance, between day staff and shift staff, between the site and a contractor.

Each is a point at which the state of equipment, the status of work and the existence of bypasses can be lost. The same principles apply — structured, recorded, with confirmation of understanding — and they are usually applied less rigorously.

Handover records as evidence

Shift logs form part of the operational record and are examined after any incident. Written accordingly — factually, with times, without speculation — they are useful evidence. Written casually, they can be misleading.

This is worth stating in training rather than leaving to individual judgement, and it is another reason for a structured format rather than free text.

Fatigue and the end of a shift

Handover occurs at the point of maximum fatigue for the outgoing operator, after eight or twelve hours. Recall and thoroughness are measurably reduced.

Building the handover document progressively through the shift, rather than composing it at the end, addresses this directly. Items recorded when they occur are recorded accurately; items recalled at the end of a night shift are recorded partially.

Handover at the start of an outage

Shutdowns and turnarounds produce a plant state that changes rapidly, involves many more people than normal, and generates a large number of bypasses, isolations and temporary conditions.

Normal handover arrangements are frequently inadequate for it. Sites that manage this well use an enhanced handover during outage periods, with the isolation register and bypass list as explicit agenda items.

The transition back to normal operation deserves the same attention, because the accumulated temporary conditions have to be systematically removed and verified, and that is where items get missed.

Auditing handover quality

Handover is a process like any other and can be observed and improved. Periodically sitting in on handovers, and reviewing logs against what actually happened during the shift, identifies systematic omissions.

The common findings are consistent: bypasses not mentioned, ongoing work described vaguely, and conditions the outgoing operator had grown used to and no longer regarded as noteworthy.