A Shift Handover That Carries the Open Fault
US water and wastewater operations have no published shift-handover standard I could find. Process safety has one, free since 1996, and it maps onto a plant control room almost unchanged. Here is the translation, plus a one-page sheet that carries an open fault across the boundary with its evidence attached.
Working on a live operating problem? Book Your 20-Minute Assessment
Four things can cross a shift boundary, and only two of them travel on their own. The alarm and the work order survive because SCADA and the computerised maintenance management system hold them. Evidence and reasoning die at 06:00, because no system holds them. The UK Health and Safety Executive published the structure that fixes this thirty years ago, in the literature review behind its human factors guidance: Offshore Technology Report OTO 96 003, issued June 1996 and still free to read through the UK Government Web Archive.
Key takeaways
- Four things can be handed over: the alarm, the work order, the evidence, and the reasoning. Only the first two survive most handovers by default, because only the first two live in a system that persists them.
- The guidance already exists and costs nothing. HSE says a handover should be conducted face to face, two way with both participants taking joint responsibility, via verbal and written means, based on an analysis of the information needs of incoming staff, and given as much time and resource as necessary.
- The incident record behind that guidance is a maintenance record. The review names plant maintenance as its first area of risk, and each of the three investigations summarised below involved maintenance work that crossed a shift change. At Sellafield in November 1983 a tank description degraded as it was copied from shift log to shift log, and highly radioactive liquor went to sea.
- Uptime Institute’s Annual Outage Analysis 2026, its eighth annual edition, announced 13 May 2026, reports that failures to follow established procedures remain the leading driver of human-error-related outages. In that class of outage the procedure fails, not the equipment. That release publishes no percentage for human error.
- I could not find a published shift-handover standard for US water and wastewater operations. The state operator rule I checked, Florida’s, requires a log of what was done: a different artifact answering a different question.
- The column that does the work is “do not assume”. It is the only field that stops the incoming shift re-deriving a conclusion the outgoing shift already reached.
What is actually lost between 06:00 and 08:00
At 03:42 a vibration alarm comes in on a raw sewage pump. The night operator does real diagnostic work over the next two hours. She rules out cavitation from the suction pressure trend, swaps duty to the standby, isolates the faulty unit, turns the shaft by hand and feels roughness at the outboard end. By 05:30 she has a defensible hypothesis: an outboard bearing, not a coupling and not an alignment problem, because the temperature moved first and the vibration followed.
At 06:00 she goes home.
At 08:00 the day maintenance planner opens the work order. It says: high vibration, Pump 2, investigate. He opens the historian and starts at the beginning. Nothing was hidden and nobody was careless. The work order recorded that work happened, not what it concluded. Two hours of narrowing were performed, then performed again.
This happens reliably, because the four things that can cross a shift boundary have very different survival rates.
| What can be handed over | What it is | Survives by default | Why |
|---|---|---|---|
| The alarm | The machine-generated fact that a limit was crossed | Yes | SCADA and the alarm historian persist it whether anyone acts or not |
| The work order | The administrative record that work was raised and assigned | Yes | The CMMS is a system of record and this is exactly what it records |
| The evidence | Trend exports, photographs, meter readings, the strainer differential someone checked at 04:50 | Rarely | Created outside any system, and where it was saved is known only to the person who saved it |
| The reasoning | Which hypotheses were eliminated, and on what basis | Almost never | No field holds it, so it exists only as the outgoing person’s recollection, and they have gone home |
A handover sheet earns its place only if it moves rows three and four. The first two need no help.
Why process safety has published guidance for this and water does not
Searching AWWA, WEF and EPA published material, I could not find a shift-handover standard or manual of practice for US water and wastewater operations. If one exists I have not located it, and I would rather say that than assert a gap I cannot prove.
What the state operator rule I read requires is a log. Florida’s Rule 62-602.650, Duties of Operators, amended effective 6 November 2025, requires an operation and maintenance log for each plant, kept on site in a location accessible to 24-hour inspection, each entry carrying the identification of the plant, the signature and licence number of the operator making it, date and time in and out of the plant, a description of specific operation and maintenance activities, and the results of tests performed and samples taken. That is a good rule. It is also a record of activity rather than a transfer of understanding: it answers “what was done here” for a regulator, not “what should the next person believe” for a colleague.
Process safety went through this and came out the other side. The Health and Safety Executive commissioned Ronny Lardner of The Keil Centre to review the literature for its Offshore Safety Division and published the result in June 1996 as Offshore Technology Report OTO 96 003, Effective Shift Handover. It states the goal in one sentence that transfers to a water plant without editing: “The goal of shift handover is the accurate, reliable communication of task-relevant information across shift changes, thereby ensuring continuity of safe and effective working.” It also describes shift changeover as three parts: a period of preparation by outgoing personnel, the handover itself, and cross-checking of information by incoming personnel as they assume responsibility. HSE’s own human factors topic page carries the same three elements. Most plants have the middle part and neither of the others.
One caveat on how to read the report. It is a literature review prepared for HSE by an outside author, and it carries HSE’s standard disclaimer that its contents are the author’s and do not necessarily reflect HSE policy. The principles quoted in this article are the ones HSE also publishes in its own name on its shift-handover topic page, so they are not resting on the review alone.
What the incident record says about where handovers fail
The HSE material is grounded in investigated accidents rather than opinion, and the pattern is specific. The review examines five published investigations in which failure of communication at shift handover was held to be a contributory causal factor. Three of them carry the structure most directly.
Sellafield, November 1983. Highly radioactive waste liquor was accidentally discharged to sea during a plant shutdown for routine annual maintenance. The Nuclear Installations Inspectorate investigation found that a tank assumed to contain liquid suitable for discharge in fact contained highly radioactive material. Its written description had been carried forward from one shift log to the next across several consecutive shifts, and in the copying it changed from “ejections from HASW” to “ex HASW washout”. The contents had been described in terms of their origin rather than their nature, and the meaning degraded on the way through.
Piper Alpha, July 1988. The Cullen Report concluded that one of the many contributing factors was failure of transmission of information at shift handover: that a pressure safety valve had been removed and replaced by a blind flange was not communicated between shifts, and lack of that knowledge led to the incoming shift taking actions which initiated the disaster. Cullen concluded there were no written procedures for shift handover, that the type of information the lead production operator wrote on his notepad was left to his discretion, and that maintenance work was not always included in logs.
Windscale vitrification plant, September 1991. A temporary plant modification proposal was issued during maintenance on a cell robot to temporarily override a programmable logic controller. The work continued over four consecutive shifts, and the control cell was re-commissioned without removal of the override: an initial reference to its existence had not been carried forward from shift to shift in the shift manager’s log book.
The review’s summary of these incidents lists the areas of risk: during plant maintenance, particularly when the work continues over a shift change; when safety systems have been overridden; during deviations from normal working; following a lengthy absence from work; and when handovers are between experienced and inexperienced staff.
Read that list against a water utility and it describes the on-call night. In AWWA’s 2026 State of the Water Industry report, among the 769 utility respondents to the reasons-for-overtime question, 29.5% said on-call response requirements often lead to overtime and 30.4% said always, together 59.9%. For emergency repairs and system failures, 32.1% often and 22.1% always, together 54.2%. That is a frequency scale, not a share of overtime hours or cost, and it cannot be converted into one. The free executive summary reports 56% for the on-call row against the full report’s Table 18 figures used here, so cite the exhibit and its base rather than the summary sentence. What the table establishes is that this boundary gets crossed often, frequently by someone arriving cold.
The same thesis holds outside water. Uptime Institute’s Annual Outage Analysis 2026, its eighth annual edition, announced 13 May 2026, reports that failures to follow established procedures remain the leading driver of human-error-related outages, and that inconsistent or unclear processes are also common. That release attaches no percentage to human error; the percentages circulating online come from the 2025 edition. The qualitative finding is what matters here. In that class of outage, the procedure fails, not the equipment.
What HSE says a handover must be, translated to a control room
HSE lists five characteristics of an effective shift handover. The wording below is the review’s; HSE’s topic page states the same five in slightly shorter form.
| HSE characteristic | What it looks like at a treatment plant | The failure it prevents |
|---|---|---|
| Conducted face to face | A scheduled overlap, not a note on the desk or a text message | The incoming operator forms an assumption with nobody present to correct it |
| Two way, with both participants taking joint responsibility for ensuring accurate communication | The incoming operator reads the open items back and asks for clarification; that is their job, not a courtesy | Misunderstandings only the receiver can detect, which is most of them |
| Via verbal and written means | The sheet structures the conversation; the conversation elaborates on the sheet | The written record loses its meaning in transit, as at Sellafield |
| Based on a pre-determined analysis of the information needs of incoming staff | Fixed fields agreed in advance by the people who use them, not a free-text diary | Content left to discretion, as Cullen found on Piper Alpha |
| Given as much time as necessary to ensure accurate communication | Longest where the risk is: open faults, overrides in place, work spanning the change, anyone returning after time away | A uniform five minutes applied to a shift with an open fault and an isolated pump |
One further point in the same guidance is the cheapest control on the list: where possible, plan maintenance work to be completed within one shift, eliminating the risk of miscommunicating maintenance issues at handover. Where the work does continue over a shift change, the review’s position is that thorough communication of it should be afforded a very high priority.
Structuring the written half has field evidence behind it. In the UK oil refinery intervention described in OTO 96 003, process operators and supervisors defined the information they needed at the start of a shift and those categories became structured log books for each post, a project affecting 315 personnel in 63 posts refinery-wide. Two to three months after implementation, 70 personnel, which the report puts at 21% of users, were interviewed. Three quarters of them believed the structured logs had a beneficial effect on how log books were completed, citing greater continuity between shifts, more information being passed between shifts, and key items such as equipment out of service being recorded in writing and discussed verbally.
Four things can cross a shift boundary. Two usually do.
Scroll sideways to see the whole drawing.
Figure 1. Four things can cross a shift boundary. Two usually do.. Four columns describing what can be handed over at a shift change. Column one is the alarm, which survives by default because the system holds it. Column two is the work order, which survives by default because the maintenance system holds it. Column three is the evidence, which survives only if somebody attached it. Column four is the reasoning, which survives only if somebody wrote it down and is otherwise lost when the person goes home. A shared band beneath all four states that only the first two are carried by a system without anyone deciding to carry them.
The handover sheet
One page, open items only. A closed item belongs in the work order. Copy this table:
| Asset | What is known | What was tried | Waiting on what | Owner | Do not assume | Evidence and where |
|---|---|---|---|---|---|---|
Each column answers one question and has a completeness test.
| Column | What goes in it | The row is not finished until |
|---|---|---|
| Asset | The tag the CMMS uses, plus the location a person would drive to | A technician who has never seen the site could find it |
| What is known | Observations with times and values. Facts, not conclusions | Every statement can be checked against a record |
| What was tried | Actions taken and what each ruled in or out. This is the reasoning column | The reader can name a hypothesis that has been eliminated, and why |
| Waiting on what | The blocker: a part, a person, a permit, a test, a vendor callback, a window | The blocker has a name and, where possible, a time |
| Owner | One named person on the incoming shift, not a crew or department | Someone has accepted the row by name |
| Do not assume | The wrong inference the evidence invites, stated outright | It names something a competent person would otherwise conclude |
| Evidence and where | File paths, work order numbers, photograph locations, log entry times | Everything referenced can be opened without asking the person who made it |
Two rules keep it honest. The outgoing person fills a row in when the finding is made, not in the last ten minutes before they leave. And a row leaves only when the item closes, at which point its content is pasted into the work order, so the CMMS ends up holding the history.
A worked example: a partially diagnosed pump fault
The 03:42 alarm from the opening, written as one row and laid out vertically to read. The plant, the tags and the times are invented for this article.
| Field | Entry |
|---|---|
| Asset | Pump 2, Raw Sewage Pump Station 4, duty and standby pair with Pump 1. CMMS tag RSPS4-P02 |
| What is known | 03:42 high vibration alarm, outboard end. Bearing temperature rose 11 degrees C between 03:00 and 03:40, then held flat at 68 degrees C. Discharge pressure unchanged. Flow within 3% of the duty curve at the same wet-well level. Temperature moved first, vibration followed |
| What was tried | 04:05 duty swapped to Pump 1, station stable since. 04:15 Pump 2 stopped, isolated, locked out, tag LO-2291. 04:30 shaft turned by hand: roughness at the outboard end, none at the drive end. 04:40 coupling guard off, alignment marks intact and matching. 04:50 suction strainer differential normal, so partial blockage ruled out. Cavitation ruled out from the suction pressure trend, which never moved |
| Waiting on what | Fitter with a dial indicator to check shaft runout, first job on days. Bearing part number to be read off the pump nameplate: the storeroom shows 2 on hand under a superseded number, so the count is not trustworthy yet |
| Owner | Handed from D. Okoye, night shift lead, to the day maintenance planner by name at the 06:00 overlap, and accepted |
| Do not assume | This is not the March event on Pump 1. That was a loose foundation bolt. Pump 2’s bolts were torque-checked on 12 August and the sequence here is different: temperature led, vibration followed. Do not start with alignment, which was checked at 04:40 and is intact. Start with runout |
| Evidence and where | Historian export of vibration and bearing temperature, 02:00 to 05:00, on the plant share at RSPS4 / 2026-09-07 / P2-vib-temp.csv. Two photographs of the coupling and alignment marks in the same folder. Work order WO-48213 in the CMMS, with the 04:15 isolation and lockout tag recorded. Shaft roughness noted in the shift log at 05:10 |
The day planner now starts where the night operator stopped. The alarm told him a limit was crossed. The work order told him a job exists. This row tells him which two hypotheses are already dead, which one to test first, that the storeroom count cannot be trusted, and where the trend file is.
What this does not solve
A sheet does not create the overlap it needs. If the outgoing operator leaves before the incoming one arrives, there is no face-to-face handover to structure, and the page drifts back toward the unstructured diary the refinery study set out to replace. It does not diagnose anything either. It carries reasoning, and whether that reasoning was good is answered by the plant’s competence and instrumentation, not its paperwork.
The sheet is also only as good as the discipline of writing the “do not assume” column truthfully. That column asks a person to record what a reasonable colleague would get wrong, which is close to recording what they nearly got wrong themselves. It will be the first column to go blank.
Who wrote this
EQUA AI builds EQUA AIMMS, and the column it works on is evidence.
When a fault is still open at a shift boundary, AIMMS has already assembled the trend, the history and the sources behind it, and kept them attached to the fault rather than scattered across the systems they came from. The operator coming on at 06:00 inherits the reasoning, not just the alarm. The sheet above works on a clipboard without any of that. It works considerably better when the evidence column fills itself.
Sources
- Health and Safety Executive (UK). “Shift handover.” Human factors topic page, hse.gov.uk. Quoted for the three elements of handover and the five characteristics. https://www.hse.gov.uk/humanfactors/topics/shift-handover.htm
- Lardner, Ronny (The Keil Centre). “Effective Shift Handover: A Literature Review.” Prepared for the Health and Safety Executive, Offshore Safety Division. Offshore Technology Report OTO 96 003, June 1996. Free through the UK Government Web Archive, as linked from the HSE topic page above. https://webarchive.nationalarchives.gov.uk/ukgwa/20230103120103/https://www.hse.gov.uk/research/otopdf/1996/oto96003.pdf
- Health and Safety Executive (UK), 1983. “The contamination of the beach incident at British Nuclear Fuels Limited, Sellafield, November 1983.” London: HMSO. Cited here as summarised in OTO 96 003, section 4.1.
- Department of Energy (UK), 1990. “The Public Inquiry into the Piper Alpha Disaster” (the Cullen Report), Cm 1310. London: HMSO. Shift-handover findings cited here as summarised in OTO 96 003, section 4.2.
- Health and Safety Executive (UK), 1991. “Windscale Vitrification Shield Door Incident, 15 September 1991.” London: HMSO. Cited here as summarised in OTO 96 003, section 4.4.
- Adamson, S. S. and Lardner, R. “Safe communication at shift handover: setting and implementing standards.” IChemE Symposium Series No 139, pp. 411 to 424, 1995. The refinery intervention figures (315 personnel, 63 posts, 70 interviewed) are cited here as reported in OTO 96 003, section 5.2(d).
- Uptime Institute. “Uptime Announces Annual Outage Analysis Report 2026.” Press release, 13 May 2026. Quoted: “For 2026, failures to follow established procedures remain the leading driver of human error-related outages.” The full report is not public and nothing is quoted here from it. https://uptimeinstitute.com/about-ui/press-releases/uptime-announces-annual-outage-analysis-report-2026
- American Water Works Association. “2026 State of the Water Industry” full report, published 30 April 2026 (survey fielded 21 September to 31 October 2025, n=2,171). Table 18, “Reasons for Overtime,” n=769 utility respondents, a frequency scale. Supplied through the request form on the report page. https://www.awwa.org/state-of-the-water-industry/
- American Water Works Association. “2026 State of the Water Industry: Executive Summary,” published 30 April 2026. Free PDF; source of the 56% figure for the on-call row noted above. https://www.awwa.org/wp-content/uploads/SOTWI-2026-Executive-Summary.pdf
- Florida Administrative Code, Rule 62-602.650, “Duties of Operators.” History: new 30 December 1999, amended 6 February 2002, 15 October 2007 and 6 November 2025. https://www.flrules.org/gateway/ruleNo.asp?id=62-602.650
- US Environmental Protection Agency. “Operator Certification Guidelines: Implementation Guidance,” EPA 816-R-00-022, January 2000. Reviewed for shift-handover content; it addresses certification and operator availability per operating shift, not handover procedure. https://www.epa.gov/system/files/documents/2025-01/operator_certification_guidelines_-_implementation_guidance_0.pdf