Pattern 13 · Transition
Operator-to-Operator Handover
When responsibility for a machine passes between people — shift change, remote operator to local — the system carries its true state across, including work in progress and anything disabled, rather than relying on memory and paper.
The mechanism
shift ends → responsibility moves
- 01Shift endsResponsibility is about to move
- 02Machine states its own conditionMode, work in progress, what is disabled
- 03Structured, not freeformThe same fields every time
- 04 · Key momentReceiver restates itIn their own words, back to the sender
- 05Responsibility movesRecorded, with both parties named
At 02: The disabled things are the dangerous ones. At Piper Alpha a pressure safety valve had been removed from condensate pump A and a blind flange fitted in its place, with the work unfinished at shift end.
At 04: I-PASS ends with synthesis by the receiver. In a nine-hospital study of 10,740 admissions, medical errors fell 23% and preventable adverse events 30%, without handoffs taking longer.
Without / with the pattern
Anti-pattern: Lost at Shift Change
Work unfinished, then Handover by memory, then Next shift acts blind
Lost at Shift Change: the permits for the pump work and the valve work were separate and not cross-referenced. That night the other pump failed, and the night shift restarted pump A without knowing its safety valve was missing.
With the pattern
State assembled, then Receiver restates it, then Responsibility recorded
The machine's real condition travels with the responsibility, and the receiver has to say it back before it is theirs.
Related patterns
- Complements · 01The HandoffThe Handoff moves control between a machine and a human. This moves it between two humans, where the state has to survive a gap in which nobody is watching.
- Complements · 08Provenance LogA handover is a state change with two actors, and worth recording as one. Who accepted the machine, and in what condition, is exactly the question asked afterwards.
Sources
The structural detail in Piper Alpha is the one worth carrying: the permits for the pump work and the valve work existed, and were separate, and were not cross-referenced.3 Nobody lost the information. The system simply had no way to put two facts next to each other — this pump is being worked on, this pump's safety valve is gone — and the handover depended on somebody holding both at once. Lord Cullen's finding was not that a step was skipped but that there was no clear procedure for shift handovers at all, and that the permit system was habitually departed from.2
What I-PASS adds is the receiver's half. Most handover design concentrates on what the outgoing operator says, which is the easier problem; the hard one is whether the incoming operator has actually built the picture. Making the receiver synthesise it back is a check on the transfer rather than on the sender, and the nine-hospital result suggests it is cheap — the errors fell and the handoffs did not get longer.1 For a machine the equivalent is not a summary screen. It is being made to state what you think you have just taken charge of, including what on it is switched off.