Shift handover, suspension and long-duration work

Plants run around the clock, and many jobs outlast the shift on which they began. Every time responsibility passes from one person to another, information can be lost. The Piper Alpha disaster in 1988 turned on exactly this kind of loss: a pressure safety valve had been removed from a pump under one permit, the work was not finished by the end of the day shift, and the night shift, unaware that the valve was missing, started the pump when its partner tripped. This lesson explains how permit systems manage handover between shifts, suspension and revalidation of work, extensions, and jobs that run for days or weeks.

Why handover is dangerous

Research on shift handover in the process industries, much of it prompted by Piper Alpha and later incidents, has identified recurring problems. Handover is often rushed, because the outgoing shift wants to go home. It is often verbal and unstructured, so important details depend on memory. Incoming staff may arrive late, be distracted or lack the background to understand what they are told. Information about unusual plant states, such as removed equipment, temporary repairs, bypassed alarms and suspended permits, is exactly the information most likely to be lost, because it is out of the ordinary. The UK HSE and the Energy Institute have both published guidance stressing that handover must be structured, written as well as spoken, and done face to face.

Structured handover

A good shift handover for permitted work includes:

• A written handover log or electronic record listing every live and suspended permit in the area, with its status, the state of the work and any problems.
• A face-to-face meeting between outgoing and incoming issuers or area authorities, ideally with the logs and permit board in front of them.
• A review of every permit that is suspended or will need revalidation, including the state of the equipment and any conditions that have changed during the shift.
• Explicit mention of any abnormal plant states, such as equipment out of service, relief valves removed, blinds fitted, alarms or trips inhibited and long-term isolations.
• Time to ask questions. The incoming person should confirm their understanding, not just listen.
• Overlap of shifts long enough to allow all of this, which may mean paying for 15 to 30 minutes of overlap.

Permit holders and work crews need their own handover. When a job passes from one crew to the next, the outgoing holder briefs the incoming holder at the work site, showing them what has been done, what remains and any hazards that have appeared.

Suspension

A permit is suspended whenever work stops before it is finished: at the end of a shift, for a meal break if the site requires it, during an emergency or alarm, when conditions change, or when work must wait for parts or another activity. Suspension is a formal step, not just walking away. Typical requirements are:

• The work party leaves the work site in a safe condition: openings covered or closed, tools removed or secured, hot work equipment shut off, barriers in place.
• The holder records the state of the work on the permit, for example 'flange unbolted, new gasket not yet fitted, line open to atmosphere at flange F-12'.
• The holder and issuer sign the suspension section, and the permit is returned to the control room or permit office or marked as suspended on the board.
• Isolations stay in place unless the issuer decides to reinstate the plant, in which case the permit must be closed or fully reassessed.
• For confined spaces and hot work, specific controls such as attendants, fire watches and post-work fire checks continue as required by those permits.

Revalidation

Before work resumes on a suspended permit, the issuer and the holder revalidate it. Revalidation is not a formality; it is a fresh check that conditions are still as they were when the permit was first issued. It usually includes:

• Checking at the work site that every isolation on the linked certificate is still in place and secure.
• Repeating gas tests and recording the results.
• Checking for changes in the area, such as new work nearby, weather or operational changes.
• Confirming that the holder and the crew are briefed, particularly if they are different people from the previous shift.
• Signing and timing the revalidation section.

Extensions and long-duration work

Sometimes a job will clearly take longer than the permit allows. Rather than letting work run beyond the validity period, the holder requests an extension before the permit expires. The issuer considers whether conditions have changed and whether the original assessment still holds, and either extends the permit with fresh checks or requires a new permit. Many sites cap the total life of a permit, for example at 7 days or 14 shifts, after which a new permit and a fresh assessment are mandatory.

Long-duration work, such as a turnaround on a large vessel or a construction project inside an operating plant, needs special arrangements. Common approaches include area permits that cover a defined work zone for a set period, with daily task permits or task cards within the zone; dedicated issuers for the project; and a permit coordinator who tracks all permits, isolations and revalidations for the project.

Handover of isolations and abnormal states

Isolations and abnormal plant states deserve special attention at handover. Long-term isolations, removed relief valves, blinds left in lines, inhibited alarms and temporary repairs must be listed in the handover log and checked against a register. Some sites require a physical walk-round by the incoming area authority at the start of every shift to check all isolations and abnormal states in person. Electronic systems can generate a handover report automatically from live permits, isolations and overrides, which reduces the chance that something is forgotten, but the face-to-face conversation is still needed.

Fatigue and staffing

Handover quality depends on people being alert. Long shifts, extended overtime during shutdowns and quick shift rotations all increase fatigue, and fatigue makes handover errors more likely. HSE-109 covered fatigue and hours of work. Permit system owners should make sure that shutdown staffing plans allow for proper handover, that issuers are not routinely working excessive hours, and that handover is never squeezed out by production pressure.

In the US, OSHA has no general hours-of-work limit, and the API RP 755 fatigue risk management standard is widely used in refineries and petrochemical plants to cap hours and consecutive shifts, including for permit issuers and operators.

Handover between operations and maintenance

Handover happens not only between shifts but also between groups. When a job is finished, the equipment passes from maintenance back to operations; when a shutdown begins, a whole unit passes from operations to the turnaround team; when commissioning ends, new equipment passes from the construction contractor to the owner. Each of these transfers needs the same discipline as a shift handover: a written record of the state of the equipment, any outstanding work, temporary changes and isolations; a face-to-face meeting; and a formal acceptance signature. Many incidents have occurred when equipment was returned to service with a blind still fitted, a valve left closed or a temporary repair forgotten, because the handback was informal.

Measuring handover quality

Sites can check the quality of handover in simple ways. A supervisor can sit in on a handover meeting and note whether every live and suspended permit was discussed, whether abnormal states were mentioned and whether the incoming person asked questions. Handover logs can be sampled to see whether they are complete. Incidents and near misses can be reviewed to see whether lost information played a part. These checks feed into the leading indicators described in Lesson 12.

Practical tips for shift-change crunch

Shift change is often the busiest time for issuers, with permits to suspend, hand over and revalidate all at once. Sites reduce the crunch by staggering crew start times, so that not every job needs revalidation in the first 15 minutes; by having the outgoing issuer pre-check isolations on long-running jobs late in their shift; by grouping revalidations geographically so the incoming issuer walks one efficient route; and, during shutdowns, by assigning dedicated revalidation issuers. None of these remove the need for a field check, but they give issuers the time to do it properly.

Communicating with crews about suspended work

Work crews need clear signs that a job is suspended. A suspended permit should be marked as such at the work site, for example with a suspension tag on the permit holder or a sign at the barrier, so that no one restarts work by mistake. Crews arriving for the next shift should go first to the issuer or permit office, not straight to the job, so that revalidation happens before they touch anything. Some sites keep crews' tools locked up overnight for high-risk jobs to make an unauthorized restart physically harder. These small practices close the gap between the paperwork and what people actually do when they arrive at the job.

A short case: the forgotten blind

Consider a composite case, typical of many reported incidents. A day crew fits a blind in a nitrogen line so they can replace a valve downstream. The valve is replaced, but the reinstatement is left for the night shift. The day issuer mentions the valve job at handover but not the blind, which is recorded only on the isolation certificate in the permit rack. The night shift closes the permit after a quick look, the blind is not on any handover log, and weeks later a purge fails because no nitrogen reaches a vessel. Nobody was hurt this time, but the same pattern, a temporary change lost at handover, lies behind some of the worst accidents in industry. A blind register, a structured handover and a close-out inspection against the isolation certificate would each have caught it.