Operator-to-Operator Handover
When responsibility passes between operators, the system carries the machine's true state across, including unfinished work and anything switched off.
Piper Alpha oil platform
July 6, 1988 · North Sea
That day, engineers removed a safety valve from one of the platform's two condensate pumps and sealed the open pipe with a temporary cover. The work wasn't finished when the day shift ended, and the permit for the valve work was kept separately from the permit for the pump, with nothing connecting the two. That night the other pump failed, and the night shift, not knowing the valve was gone, restarted the first one. Gas escaped through the temporary cover and ignited, and the explosions and fires that followed destroyed the platform and killed 167 people.2,3,4,5
Anti-pattern: Lost at Shift Change
Nobody lost the information. Both facts existed: this pump is being worked on, and this pump's safety valve is gone. But they sat on separate pieces of paper, and the handover depended on someone holding both in their head at once.3 Lord Cullen found there was no clear procedure for shift handovers at all, and that the permit system was routinely not followed.4
Operator-to-Operator Handover
Therefore: Carry the machine's true state across every change of operator, in the same form every time, with anything disabled shown first, and have the person taking over say back what they're taking charge of.
Simplified illustration.
Without
Shift handover
The day shift leaves a note. You are the night shift.
With the pattern
Shift handover
The same shift change, on a console that hands itself over.
The machine's real condition travels with the responsibility, and the receiver has to say it back before it is theirs.
The mechanism
shift ends → responsibility moves
- 01Shift endsResponsibility is about to move
- 02Machine states its own conditionMode, work in progress, what is disabled
- 03Structured, not freeformThe same fields every time
- 04 · Key momentReceiver restates itIn their own words, back to the sender
- 05Responsibility movesRecorded, with both parties named
On this page
Design considerations
- Put related facts side by side. At Piper Alpha the two permits existed but weren't cross-referenced. The handover view should show everything about a piece of equipment in one place.3
- Show what's disabled first, and loudest. Things that are switched off, removed or bypassed are the items most likely to hurt the next person.
- Use the same fields every time. A structured handover can't leave out what a free-text note forgets.
- Have the receiver say it back. Most handover design focuses on the person leaving, which is the easier problem. Checking whether the person arriving has actually built the picture is the harder, more valuable one.1
- Record who handed over to whom. Who accepted the machine, and in what condition, is exactly the question asked afterwards, which is what Provenance Log is for.
In the field
Observed · Industrial. Piper Alpha: the permit for the pump and the permit for its safety valve were separate and uncross-referenced, so the night shift restarted a pump whose valve had been removed.32
Observed · Medical. I-PASS, a structured handoff program used across nine hospitals, where medical errors fell 23% and preventable adverse events 30%.1
Related patterns
- Complements · 01The HandoffThe Handoff moves control between a machine and a human. This moves it between two humans, where the state has to survive a gap in which nobody is watching.
- Complements · 08Provenance LogA handover is a state change with two actors, and worth recording as one. Who accepted the machine, and in what condition, is exactly the question asked afterwards.
Sources
For a machine, the equivalent of I-PASS isn't a summary screen. It's asking the incoming operator to state what they think they've just taken charge of, including what on it is switched off.