“The night shift was told, yet a held lot went to the next operation.” “The morning shift thought a machine under maintenance was ready to run.” A factory shift handover system can address these gaps, but replacing a paper production report with a tablet is insufficient. At the boundary between shifts, the next team needs a defensible view of open work, machine and lot status, maintenance permits, and who has checked and accepted each item. This guide turns those needs into requirements, an RFP, and FAT and SAT scenarios.
Summary: hand over the current state needed for the next decision
Make a continuing case, machine, lot, or permit the unit of record rather than a day’s report. Support three steps: the outgoing team prepares, both teams exchange information, and the incoming team checks the record against the source and physical site before accepting responsibility. The UK HSE describes those three elements in its shift handover guidance. That guidance is a useful design reference; it is not a statement of Thai legal obligations. Local safety procedures, permits, and applicable law govern the actual operation.
Start with a one-page table of conditions that must pause a decision at shift change and the criteria for acceptance. Put that table into the RFP. Use FAT to test the agreed business rules, and SAT to test a real line, devices, network, and people during an actual shift transition.
If you are mapping open work or equipment status at the shift boundary, contact TOMAS TECH. A current handover form and a short description of the target line are enough to start defining fields and test scenarios, even before the system scope is final.
What is a factory shift handover system? How is it different from rostering and daily reports?
A shift scheduling system says who should work and when. It can nominate the next receiver, but a name on the roster does not show that the person checked the situation. Record the actual receiver separately, especially when there are substitutes, absences, or temporary support workers. A handover system follows continuing work and current equipment conditions across the boundary.
Manufacturing daily report digitization is useful for recording and aggregating output, defects, stoppages, and work over a period. A period summary alone rarely answers whether a held work-in-process lot may be released now or whether an isolated machine can be used. Handover complements the daily report by tracking unresolved items and linking to the underlying records.
A work instruction system presents an approved method and version. Handover communicates temporary conditions: a deviation awaiting approval, a provisional maintenance measure, a trial-run condition, or a check required before restarting. Merely linking an instruction is not enough; explain which condition applies to the current lot or machine.
Three questions define the boundary. Can the next shift decide its next action without calling the previous team? When the physical site and the digital record disagree, is the priority procedure clear? If the receiver raises a doubt, who pauses work and who resolves it? Electronic signatures cannot fill a missing answer to the third question.
Why does information disappear at shift change?
Production results may live in the daily report, quality decisions in inspection records, failures in a maintenance application, and isolation or work permits on separate forms. Each register may be accurate, yet the receiver must reconstruct the line’s current state in minutes. Information can be lost through fragmentation even when it has been recorded somewhere.
The HSE describes preparation by outgoing personnel, communication between outgoing and incoming personnel, and cross-checking by incoming personnel. Its guidance also recommends face-to-face, two-way handover using both verbal and written communication, designed around the incoming team’s information needs. The purpose of a screen is to expose exceptions for discussion and subsequent checks, not to remove the discussion. Allocate time for those checks; otherwise “accepted” can become a formality.
A common weak note is “Machine A being adjusted.” It says nothing about power and isolation status, the maintenance owner, who may authorize a trial run, the lot inside the machine, or the next permitted action. “Hold lot B” omits the physical location, tag, reason, release authority, and whether substitution is allowed. If the receiver has to invent these details, the handover is incomplete.
Late changes are especially important. An outgoing operator may finish the record at 16:50, maintenance may change an isolation condition at 16:57, and the receiver may read the old screen at 17:00. Show event time and last refresh time. Reopen checks when a high-priority item changes before acceptance. If a device or connection fails, display the last synchronized time and switch to the site’s defined fallback procedure.
Data model: separate open cases, machines, lots, and permits
Avoid one large free-text box. Four records answer different questions. An open case explains what remains unresolved. Machine status shows what is presently possible. Lot status shows which material can proceed under which conditions. A permit states who authorized a defined job under defined conditions. Connect them with stable line, equipment, lot, and work-order IDs. Do not collapse permit status into machine status: an active permit never implies that a machine may run.
An open case should contain an ID, event time, line and equipment, affected lot, observed event, temporary measure, next action, due time, owner, priority, completion criterion, source links, and last editor. Separate observed fact from instruction. “Abnormal noise heard” is an observation; “Do not increase speed” is an instruction. Keep acceptance and approval as distinct states.
Useful machine states may include available, conditionally available, stopped, under maintenance, isolated, and awaiting decision. Adapt those terms to the plant’s procedures. Show source, verification time and person, unresolved alarms, and restart condition. PLC and sensor signals are useful inputs, but they do not replace verification of a work permit or physical isolation. “Stopped” and “isolated” are different statements.
For a lot, record its operation, physical location, quantity, quality disposition, reason for hold, possible mix-up, next-operation permission, and release authority. Preserve a history of who changed the state, when, and on what basis. If held and releasable lots share a trolley, screen colors alone will not control the situation. Include a check against physical tags and storage locations.
For maintenance and work permits, link permit number, equipment, scope, validity, issuer and receiver, isolation points, concurrent work, safe state, next-shift owner, and the condition for returning the equipment. The HSE explains that issuing a permit does not itself make a job safe. If a job spans shifts, it calls for a safe state and clear instructions to the next team. Permit issue, field verification, worker understanding, completion, and return to service must remain distinct events.
The US OSHA lockout/tagout tutorial describes orderly transfer of protective devices from outgoing to incoming personnel at a shift or personnel change. This is US regulatory material, not Thai law. As a design prompt, it asks whether protection remains continuous. Define who controls each isolation, who checks it physically, and how permit and lock or tag arrangements fit together under the plant’s own approved procedure.
Make acknowledgement mean cross-checking, not simply reading
An acknowledgement button proves that someone clicked it. It does not prove that the person understood the current plant condition. Define stages: opened list, reviewed critical items, checked against the source or physical site, and accepted responsibility without unresolved doubt. Require item-level questions and answers for critical conditions rather than a blanket acknowledgement.
The outgoing team prepares the cases and confirms late changes. The incoming team reads, walks the line, and checks lot tags and permits. If records and reality disagree, mark acceptance as pending and follow the plant’s stop, isolation, or quality-hold procedure. Show the person responsible for the next decision. Do not erase, move, or auto-complete a pending case merely because the time window expires.
Critical cases might include machines under maintenance, held lots, possible material mix-ups, temporary alarm responses, trial-run conditions, and parameter changes during handover. Severity must reflect the plant’s risk and authority framework, not color alone. A red label should always point to a required action and accountable person.
Keep an audit trail of send time, last edit, display time, acceptance time, participant IDs, the version accepted, queries, resolution, and any later re-acceptance. If wording changes after sign-off, the old sign-off must not be treated as approval of the new version. Separate an amendment to the outgoing team’s handover from a new event after the incoming team starts, and record that the receiver saw the change.
A substitute receiver should be recorded as the actual receiver with the reason and approver, while preserving the rostered person. If one person covers multiple lines, the interface should not encourage implausible simultaneous blanket clicks. In multilingual plants, translate fixed fields and read back safety-critical free text using approved site terminology. Machine translation alone should not finalize a safety instruction.
RFP requirements: specify business rules, not screen counts
“Provide a handover screen” is too weak for an RFP. Describe the life cycle of an open case and the conditions that stop a decision. Choose the first line, shift boundary, maintenance interface, and quality-hold flow. Attach anonymized examples of current forms. Convert past misunderstandings into reproducible scenarios so suppliers explain how their solution works, not merely whether a feature is ticked.
Functional requirements include case creation, priority, owner change, deadline, escalation, links to machine and lot, attachments, versioned send and receipt, pending acceptance, renewed notification, search, and audit history. Where necessary, link to existing paper permits or maintenance records. Treat conversion to an electronic permit system as a separate controlled change. The HSE advises assessing the risks of moving from paper to electronic permits and training people in the permit process as well as in the interface.
Nonfunctional requirements should cover Wi-Fi loss and recovery, time zones, shared-device login and logout, permissions, history retention, backups, search speed, and fallback when a device fails. If a Thai site exchanges data with another country, distinguish stored UTC timestamps from local display time. Test notification delay and concurrent use at the shift boundary, not just screen response during a quiet period. Avoid a “current” display when synchronization status is unknown.
For integrations, specify IDs and the direction of each update. Does ERP provide the order, MES the work-in-process state, monitoring the equipment signal, and QMS the quality hold? For every field, identify the system of record, update interval, conflict rule, offline display, and historical version. ISA-95 is a reference framework for information exchange between manufacturing operations and enterprise systems; it can help align the terminology and boundaries between ERP, MES, and equipment, but does not itself guarantee a safe handover. NIST’s digital-thread research emphasizes reuse and traceability of information across functions such as manufacturing and quality. Those sources guide integration design, not a product-performance claim.
Ask suppliers to classify each requirement as standard, configurable, custom, operational workaround, or out of scope, and to provide demo or test evidence. Compare device, connection, translation, training, support, and change costs on the same scope. A long feature list should not outweigh an inability to demonstrate pending acceptance and version changes.
Questions to put directly into the RFP
- What happens to the next-operation display and permissions if the receiver questions a handover containing a held lot?
- How are an active maintenance permit, the equipment view, physical isolation check, and responsible person linked by ID?
- If the outgoing team changes a restart condition after acceptance, what happens to the prior acknowledgement and notification?
- How are conflicting edits from two offline devices exposed and resolved?
- Can the rostered worker, actual substitute receiver, and approver all be traced separately?
- Can an auditor reconstruct the case version, machine status, and permit number at the moment a lot changed shifts?
FAT and SAT: test exceptions as well as the normal path
Factory acceptance testing checks agreed behavior before installation at the plant. With sample lines, equipment, and lots, test state transitions before, during, and after acceptance. Confirm that forbidden actions are prevented and that the log can be reconstructed. Align each scenario with the meaning of acknowledgement defined in the RFP.
Start with an ordinary open case: create it, ask a question, answer it, verify the field condition, and accept it. The case should continue into the next shift with a trace of what was checked and when. Next, introduce a held lot. Ensure the screen does not suggest release, an unauthorized user cannot lift the hold, and a split lot remains unambiguous.
For maintenance, keep a permit active and a machine isolated across the shift. Check that the explanation, field verification, permit number, isolation owner, next job, and no-restart condition appear together. Handover acceptance must never automatically release isolation or authorize startup. Change a permit condition just before acceptance and verify that an old acknowledgement triggers renewed review. HSE permit guidance and the OSHA tutorial help shape such scenarios, while local procedure approves the actual controls.
Also test connection loss, device replacement, clock differences, substitute receipt, conflicting edits, late receiver, questions after the outgoing team leaves, and post-shift additions. If offline entry is allowed, people must distinguish unsynchronized from synchronized data. Define who resolves conflicts after reconnection. Put the stop criteria in the paper fallback and assign responsibility for entering paper records back into the system.
Site acceptance testing uses the real line, plant network, shared devices, noise, gloves, and actual changeover. A readable screen is insufficient if the receiver cannot verify a lot ID at the machine. Check that digital equipment names match physical labels, that a dirty barcode has a fallback check, and that night-shift maintenance is reachable. Observe how different roles interpret the same fields and adjust ambiguous terms.
Pass or fail against business outcomes, not “the screen opened.” One criterion could be: “When the receiver disputes a held lot, the case remains unaccepted and displays the authorized resolution required before the next operation.” Record test time, data, tester, outcome, defect, correction, and retest, rather than only screenshots.
A practical rollout and measures that matter
Start with one shift boundary, one line, and one category of exception. A line where quality holds meet maintenance work shows why this differs from a daily-report project, but the pilot should still be observable and manageable. Bring operations, quality, maintenance, and IT together to watch the current handover.
Lay out the paper form, whiteboard, oral briefing, chat, and maintenance record. Trace a few past cases to see where the receiver looked after the sender left. The purpose is to find decisions that depend on individual memory, not to blame operators. Then agree case states: opened, awaiting check, ready for handover, pending receipt, received, awaiting resolution, completed, and cancelled, as appropriate. Define who may move each state. “Received” is not “completed”; an open case continues after receipt until its completion criterion is met and checked by the proper authority.
During the pilot, minimize duplicate entry while retaining existing stop, permit, and quality-disposition procedures. Post the priority procedure for a mismatch between the screen and physical plant. Review short examples with users, remove unnecessary fields before adding more, and watch the path to understanding one critical case. Click count alone is not a usability measure.
Useful leading measures include the share of open cases with a named next owner and action, share of critical cases prepared before changeover, time from pending acceptance to resolution, renewed review after a version change, and physical checks for held lots. Define denominators and evidence before interpreting rates. Safety and quality outcomes have many causes, so a short-term change should not be advertised as a system-only effect.
For a cost model, label assumptions as hypothetical. Suppose critical-case checks take ten minutes per person at each of 60 monthly handovers with two participants: 10 × 60 × 2 = 1,200 person-minutes. That is an illustrative baseline, not a saving, ROI, or claim about any plant. Measure actual work and verify that time reduction does not remove necessary cross-checks. Faster acknowledgement alone may be a worse outcome.
Decisions specific to multilingual Thai factories
Align equipment names, operation names, hold reasons, and permit types with the words printed at the machine. A Japanese headquarters term may not match what Thai operators say or read on labels. Maintain an approved multilingual glossary for fixed fields, including Vietnamese where relevant. Have site owners review translated safety conditions and update every language when the source changes.
Store shift start, machine event, entry, approval, and synchronization times separately. UTC storage and ICT display can coexist if conversion is consistent. For sites in other time zones, preserve the zone rather than assuming a constant offset everywhere. The record should show whether a change happened before or after the handover.
On shared devices, prevent the incoming worker from accepting under the outgoing worker’s login. Select practical individual authentication for gloves and shop-floor conditions. If delegated entry is needed, distinguish the editor from the approver. Review access to attached images so drawings and personal information are not unnecessarily shared.
Operations, quality, and maintenance owners must approve what status names mean in relation to isolation, restart, and release authority. UK HSE and US OSHA sources help identify questions to test. The decision about Thai law, sector rules, and customer audit requirements belongs to the relevant local owners and specialists.
A handover screen in practice: how the next team reads one case
Imagine an assembly line changing shifts at 17:00. Machine M-12 raises a temperature alarm at 16:40. The outgoing team records the alarm time, measured value, lot L-305 being processed, and latest inspection result. If maintenance is investigating, link the maintenance owner, temporary field measure, next check time, and person authorized to decide on restart. “Alarm occurred; maintenance informed” leaves the receiver unable to tell what has been checked or which operation can proceed.
At the top of the case, separate “actions allowed now” from “actions prohibited now.” An example could say “hold new input,” “place processed lots on the identified shelf,” and “require maintenance and quality review after alarm clearance.” These are illustrations that must be set according to the plant’s authority and procedure, not universal stop rules. Link the temperature history, work instruction, quality record, and maintenance order below so the receiver can reach the evidence.
If the receiver asks at 17:00 whether the shelf contains all of L-305, the sender should check the lot record and physical labels rather than guess. A quantity mismatch keeps receipt pending; record which quantity is uncertain, who will check, and by when. Pending receipt is a successful detection of a gap, not a software fault. A screen that forces a blanket acknowledgement makes it harder to reconstruct the decision later.
When maintenance finds the cause at 17:10, add a timed event instead of overwriting and erasing the earlier state. Notify the receiver and request renewed acknowledgement if a condition already accepted has changed. Final closure comes after the necessary restart or quality-release approvals and field checks. This single use case can be placed in the RFP so suppliers respond to the same facts.
After launch: govern old cases and exceptions
The number of open cases may rise during the first month because work previously hidden in oral exchanges or private notes is now visible. Do not treat the count alone as deterioration. Yet indefinitely old cases will obscure important ones. Review age, owner, next action, and overdue reason weekly; decide whether to close, continue, combine, or cancel each case. Record the reason and approver for cancellation while preserving the history.
Review free-text quality as well. If “please check” becomes common, inspect whether the form prompts for the needed facts before imposing a harsh character limit. Target object, present state, next action, due time, and decision owner can make a concise entry useful. Measure entry effort and auto-display data already available from a source system rather than duplicating mandatory fields.
When maintenance, quality, and production interpret the same status differently, update the glossary and worked examples monthly. If “conditionally available” leaves speed, material, or time unspecified, structured conditions may be more useful than another status label. Record when a definition changed and which line it applied to so historical records retain their meaning. Update every language version together.
Too many equal-priority notifications can hide an important change. Prioritize updates that change an action: restart condition, quality hold, isolation or permit, and owner reassignment. Tune notifications using actual misses and their consequences. Define fallback contact if a notification fails and conditions under which work cannot proceed without confirmation.
In improvement meetings, examine why receipt was left pending, not only how many cases were entered. The cause might be an incomplete screen, a late source record, a physical tag problem, or unclear authority. Separate issues that need a software change from those that need a revised shop-floor procedure or training, then retest the same scenario after correction. This ongoing review turns the system from an electronic form into support for decisions at the shift boundary.
FAQ: implementing a factory shift handover system
Is this the same as digitizing a manufacturing daily report?
No. A daily report summarizes performance and events over a period. Handover tracks the current state, next action, and actual receiver of work that remains open across shifts. Connect the two so a handover case can cite production and equipment evidence.
What drives implementation cost?
Line count, users, devices, MES/ERP/maintenance/quality integrations, electronic-permit scope, languages, network work, training, and support. Give suppliers the same scenarios and scope, and separate configuration, custom work, and operational effort. There is no universal flat price stated here.
Does an acknowledgement button replace verbal handover?
Not for critical cases. HSE recommends two-way face-to-face handover with verbal and written communication. The digital record supports preparation and traceability, while questions and physical checks remain part of the process. Set the face-to-face scope according to the plant’s risks.
Can an accepted machine under maintenance be restarted?
No. Receipt of handover, permit closure, isolation removal, return of equipment, and startup approval are distinct. Apply the plant’s authorization procedure. The HSE notes that a permit alone does not make work safe.
What should FAT and SAT emphasize?
Open cases, held lots, permits spanning shifts, pending acceptance, changes after receipt, network loss, and substitutes. FAT tests business rules. SAT tests actual devices, labels, network, and changeover constraints. Write pass criteria as business results.
Where should a plant start?
Observe several recent handovers on one line. Map where open work, machine state, lot state, and permits are recorded. Gather questions the next team cannot answer alone, then define the pending-acceptance and resolution rule. Use those real examples in the RFP and test scripts.
Conclusion
A factory shift handover system earns its value by connecting open work, equipment, lots, and permits with stable IDs and by supporting preparation, two-way exchange, and checks against physical or primary records. Keep “received” separate from “completed” and from “authorized to run.” Require a way to pause disputed cases in the RFP and test failure conditions in FAT and SAT.
To scope a pilot from your existing handover, maintenance, and quality-hold records, contact TOMAS TECH. You can begin with the information and acceptance conditions at one shift boundary before selecting the wider system.
Sources
- HSE, Shift handover
- HSE, Permit to work systems
- HSE, Good practice guidelines
- OSHA, Lockout-Tagout: Shift & Personnel Changes
- ISA, ISA-95 Series of Standards
- NIST, Enabling the Digital Thread for Smart Manufacturing
The HSE and OSHA publications are UK and US primary sources used as design references. This article makes no claim that they are Thai legal requirements or certify local compliance.
