Shift handover records: who owns an unresolved operating exception?

Topics: oil and gas shift handover, plant handover log, operating exception ownership, shift log software

Why Unresolved Exceptions Vanish Between Shift A and Shift C

When an abnormal operating condition cannot be restored within the shift that discovered or initiated it, who owns the unresolved exception across subsequent shift handovers, and how should the plant record keep it visible until formal closure?

Direct Answer: Dual ownership applies at every shift boundary: the Incoming Panel / Area Operator and Shift Charge Engineer assume immediate operational custody and monitoring responsibility for the active condition during their tour of duty through explicit line-item acknowledgement, while a designated Technical / Maintenance Action Owner retains resolution accountability when restoration depends on day-shift engineering, maintenance, or laboratory clearance. To prevent silent drop-offs, the handover system must automatically carry forward every unresolved exception as an active, pinned state object across every subsequent shift handover until verified restoration evidence is recorded.

In continuous 24/7 refinery units, gas-processing trains, tank terminals, and offshore production platforms, shift handovers are among the highest-risk operational transitions. Oil Industry Safety Directorate (OISD) safety standards and the Directorate General of Mines Safety (DGMS) Oil Mines Regulations, 2017 emphasise structured communication of abnormal plant conditions, safety-system bypasses, and ongoing maintenance isolations during shift relief (OISD Standards; DGMS Oil Mines Regulations 2017). Furthermore, where operational technology (OT) operator consoles, alarm management historians, and electronic shift logbooks interact, NIST SP 800-82 Rev. 3 highlights the importance of role-authenticated logging, audit trails, and clear boundary separation between supervisory control actions and enterprise administrative records (NIST SP 800-82 Rev. 3).

The classic failure mode in paper logbooks, Word documents, and basic electronic diary forms is second-handover decay:

1. Shift A (06:00–14:00): A wet-gas compressor suction scrubber level transmitter (LT-2104A) exhibits erratic readings during instrument calibration. Under an approved bypass permit (BYP-2026-118), Shift A places the loop on manual monitoring via sight-glass every 2 hours and writes in the Shift A narrative log: "LT-2104A placed on manual bypass under BYP-2026-118; instrument tech awaiting replacement diaphragm."
2. Shift B (14:00–22:00): The incoming Shift B operator reads Shift A's note, checks the sight-glass, and focuses their own shift narrative on a separate amine regenerator foaming upset. Because nothing new happened to LT-2104A during Shift B, the Shift B operator does not re-type the LT-2104A note at 22:00.
3. Shift C (22:00–06:00): The incoming Shift C crew reads only the Shift B summary (14:00–22:00). The active bypass on LT-2104A is no longer mentioned in the current shift handover text, and the mandatory 2-hour manual sight-glass check is missed on the night shift.

Narrative Shift Diaries vs Stateful Exception Handover Registers

Shift A (06:00–14:00)5 opening + 5 new - 4 resolved = 6 carried forward to Shift B

Shift B (14:00–22:00)6 opening + 3 new - 3 resolved = 6 carried forward to Shift C (2 escalated)

Shift C (22:00–06:00)6 opening + 1 new - 2 resolved = 5 carried forward to Day-2 Shift A

24-Hour Conservation5 initial + 9 newly raised = 14 total; 9 closed + 5 closing active (0 dropped)

Arithmetic check: Every exception across CAT-OVD Overrides/Inhibits (6), CAT-EQP Degraded Standby Equipment (4), CAT-PTW Extended Isolations (3), and CAT-QLT Pending Lab Holds (1) is conserved across all three relief boundaries.

Governance Boundary: What a Shift Handover Log Must Never Do

Before designing or configuring a shift handover exception workflow, operating companies must enforce a strict safety and regulatory boundary:

Operational Safety Boundary: A shift handover log records the existence, current status, monitoring cadence, and ownership of an operating exception. It is never an authorisation mechanism. Entering a note in a shift handover log does not authorise a safety instrumented system (SIS) bypass, an alarm inhibit, a mechanical isolation, or a deviation from safe operating envelopes. Every safety-critical exception recorded in the handover log must reference an active, independently approved Permit-to-Work (PTW), Bypass/Override Certificate, Temporary Management of Change (TMOC), or approved Standard Operating Procedure (SOP).

Three-Shift Exception Lifecycle and Escalation Workflow

1. 1. Log structured exception in active shift registerRecord inhibited alarms, temporary bypasses, degraded equipment loops, and open permits with tag ID, hazard control, and expiry timer rather than free-text diary prose.
2. 2. Conduct joint outgoing-incoming relief walkthroughOutgoing and incoming operators verify each open exception on the console and field panel; incoming operator explicitly accepts or flags disputed items at handover sign-off.
3. 3. Auto-carry unresolved exceptions into incoming shift queueAny exception not backed by a verified restoration record automatically persists on the incoming shift active board and escalates when approaching its governance limit.
4. 4. Close only on verified field restoration evidenceRemove an exception from the carry-forward register only when normal tag state, de-isolation confirmation, or CMMS completion reference is recorded.

Safety boundary: A shift handover log tracks operational continuity and exception ownership; it never substitutes for a Permit to Work, LOTO certificate, or formal MOC approval ([O066](O066-permit-record-system-requirements.md), [O065](O065-management-of-change-evidence.md)).

Four Exception Categories Requiring Mandatory Carry-Forward

1. Inhibited Alarms, Defeated Interlocks, and Manual Loop Overrides (CAT-OVD): Any control valve on manual, suppressed nuisance alarm flood, or authorised process bypass. Requires reference to the active Bypass Register ID and intra-shift manual monitoring log.
2. Degraded or Unavailable Standby Equipment (CAT-EQP): A critical 2 × 100% pump where Pump A is running and standby Pump B is racked out under LOTO (Lockout/Tagout) for seal replacement, leaving the unit with zero auto-start redundancy.
3. Extended / Suspended Permits and Isolations (CAT-PTW): Mechanical blinds, electrical isolations, or temporary hoses left in place across shift changes under a suspended or multi-shift PTW (OISD Standards).
4. Pending Quality / Custody-Transfer Verification (CAT-QLT): Off-spec rundown tank holds, bypassed fiscal meter runs operating on check-meter fallback, or pending laboratory re-sample confirmations.

Worked Example: 24-Hour (3-Shift) Exception Handover Reconciliation at a Gas Plant

Illustrative Scenario Scope: The following worked example models a 24-hour operating day (Gas Day 2026-10-18, divided into Shift A: 06:00–14:00, Shift B: 14:00–22:00, and Shift C: 22:00–06:00) at an illustrative onshore gas-processing facility (Unit-GPP-Train-2). All exception counts, timestamps, and escalation thresholds (16 hours / 2 shifts for temporary overrides) are illustrative configuration parameters; actual bypass limits and shift-relief procedures must follow site-specific OISD / DGMS safety management manuals.

Scenario Inputs Across the Three Shifts

Across the 24-hour cycle, Unit-GPP-Train-2 manages 14 total operating exceptions:

• Carried in at 06:00 (Start of Shift A): 5 active exceptions from the prior night shift.
• Newly opened during Shift A (06:00–14:00): 5 new exceptions (total active pool during Shift A = 10).
• Newly opened during Shift B (14:00–22:00): 3 new exceptions.
• Newly opened during Shift C (22:00–06:00): 1 new exception.
• Total Distinct Exceptions Tracked Over 24 Hours: 5 + 5 + 3 + 1 = 14 exceptions.

Category Breakdown of the 14 Exceptions

• CAT-OVD (Temporary Instrument Overrides / Alarm Inhibits): 6 exceptions (configured escalation threshold: max 2 consecutive shifts / 16 hours without Operations Superintendent re-authorisation).
• CAT-EQP (Standby Equipment Out-of-Service / Degraded Redundancy): 4 exceptions (configured escalation threshold: 3 shifts / 24 hours).
• CAT-PTW (Multi-Shift Mechanical / Electrical Isolations): 3 exceptions (governed by physical LOTO register and PTW validity window).
• CAT-QLT (Pending Off-Spec Condensate Rundown Lab Re-Test): 1 exception (configured escalation threshold: 1 shift / 8 hours).

Shift-by-Shift Carry-Forward and Resolution Arithmetic

1. Shift A (06:00–14:00):

   • Opening Carried-In: 5 exceptions.
   • New Opened on Shift A: 5 exceptions.
   • Gross Active on Shift A: 5 + 5 = 10 exceptions.
   • Verified & Closed on Shift A: 4 exceptions (day-shift instrument technicians restore 2 CAT-OVD transmitters; maintenance returns 1 standby glycol pump CAT-EQP to auto-standby; lab clears 1 CAT-QLT condensate tank rundown after re-test).
   • Carried Forward at 14:00 Handover (Shift A → Shift B): Shift A Carry-Forward = 10 − 4 = 6 exceptions
   • Acknowledgement Check at 14:00: Incoming Shift B Charge Engineer and Panel Operator individually acknowledge all 6 carried-forward items (6 / 6 = 100.0%).

2. Shift B (14:00–22:00):

   • Opening Carried-In from Shift A: 6 exceptions.
   • New Opened on Shift B: 3 exceptions (2 CAT-OVD manual valve overrides + 1 CAT-EQP fin-fan cooler vibration trip).
   • Gross Active on Shift B: 6 + 3 = 9 exceptions.
   • Verified & Closed on Shift B: 3 exceptions (1 CAT-OVD override restored + 2 CAT-PTW isolation permits de-isolated and box-up signed).
   • Carried Forward at 22:00 Handover (Shift B → Shift C): Shift B Carry-Forward = 9 − 3 = 6 exceptions
   • Ageing & Escalation Check at 22:00: Among the 6 items carried into Shift C, 2 CAT-OVD exceptions (EX-2026-104 on wet-gas scrubber level LT-2104A and EX-2026-107 on flare knockout drum high-level alarm suppress) have now remained open across two full 8-hour shifts (16.0 hours). The register automatically flags both items as ESCALATED — >16h Override Threshold and routes a mandatory re-validation alert to the Operations Superintendent while keeping custody pinned to the Shift C Panel Operator.

3. Shift C (22:00–06:00):

   • Opening Carried-In from Shift B: 6 exceptions (including 2 escalated CAT-OVD items).
   • New Opened on Shift C: 1 exception (1 CAT-EQP instrument air dryer switching valve fault).
   • Gross Active on Shift C: 6 + 1 = 7 exceptions.
   • Verified & Closed on Shift C: 2 exceptions (1 CAT-OVD manual loop restored after midnight process stabilisation + 1 CAT-EQP fin-fan reset verified).
   • Carried Forward at 06:00 Next-Day Handover (Shift C → Day 2 Shift A): Shift C Carry-Forward to Day 2 = 7 − 2 = 5 exceptions

24-Hour Exception Reconciliation Ledger (Unit-GPP-Train-2)

Verification Check: Opening Pool (5) + Total New Opened (5 + 3 + 1 = 9) − Total Verified Closed (4 + 3 + 2 = 9) = Closing Carried Forward (5)

Ownership Matrix and Exception Closure Rules

Observable Acceptance Tests for Shift Handover Systems

To verify that an electronic shift handover module or structured control-room register prevents exception drop-offs, execute these three acceptance tests:

1. Test ACT-O023-01 (Zero Copy-Paste Persistence Test): Create an active operating exception (CAT-OVD) during Shift A, complete the Shift A → Shift B handover without editing the exception text during Shift B, and generate the Shift B → Shift C handover pack. Pass Criteria: The unresolved exception automatically appears at the top of the Shift B → Shift C handover screen with an updated elapsed-time counter (16h / 2 Shifts) even though the Shift B operator added zero free-text narrative notes.
2. Test ACT-O023-02 (Unauthorised Override Entry Block): Attempt to log a CAT-OVD safety alarm inhibit or interlock bypass exception in the handover register while leaving the Authorised Bypass / PTW Reference ID field blank. Pass Criteria: The workflow rejects the entry or flags it immediately as an Unauthorised Control Exception requiring immediate Shift Charge Engineer intervention, preventing the handover log from acting as an informal bypass permit.
3. Test ACT-O023-03 (Verification-Gated Closure Audit): Attempt to change an open CAT-EQP or CAT-PTW exception status to Closed / Normal without recording the restoration timestamp, de-isolation certificate reference, or incoming operator verification sign-off. Pass Criteria: The system blocks closure and retains the item in Open — Carry Forward status until the mandatory restoration evidence fields are populated.

Summary and next actions

To eliminate silent drop-offs of unresolved operating exceptions across shift changes, execute these four numbered actions:

1. Separate the Exception Register from Narrative Shift Notes (Days 1–10): Redesign the control-room handover template so that unresolved overrides, standby equipment outages, multi-shift isolations, and pending quality holds live in a persistent, structured Carried-Forward Exception Table above the general shift diary commentary.
2. Assign Dual Ownership to Every Carried-Forward Line (Days 11–20): Require every open exception to display both the Active Shift Custody Role (the incoming panel or field operator monitoring the condition during the shift) and the Resolution Action Owner (the maintenance, instrument, or engineering role responsible for permanent restoration).
3. Enforce Mandatory Authority References and Ageing Escalation Timers (Days 21–35): Configure hard validation linking every CAT-OVD and CAT-PTW exception to an active Bypass Certificate or PTW number, and set automated shift-count escalation rules (such as > 2 shifts / 16 hours for temporary overrides) that notify the Operations Superintendent.
4. Audit Three Consecutive 24-Hour Handover Cycles (Days 36–45): Sample 3 consecutive days (9 shift handovers) across one process unit, reconcile every opened exception against verified restoration evidence (Opening + New − Closed = Closing), and confirm zero exceptions vanished between Shift A and Shift C without documented closure.