Shift-Handover Agents for Plant Operations

Night shift ended with a half-page of handwriting and a conversation in the doorway. The incoming panel engineer missed a remark about a vibrating pump because the remark was on a torn sheet under a tea glass. That is a real problem. A language model with a write path into the DCS is a different, larger problem.

This case study is a composite of how a heavy-industry PSU can use an agent to draft shift-handover notes without pretending the model is on the panel. We will not name a plant. We will not invent a reliability percentage. We will describe a pattern that plant OT leads will tolerate.

If your vendor's architecture has the agent querying the historian live and suggesting set-points, stop reading this as a how-to. Read the OT opinion in this batch and refuse.

The pattern that is allowed to exist

OT stays OT. Historians, PLCs, DCS, SCADA and engineering workstations are not tool endpoints. A one-way copy — diode, staged export, or a manual dump the OT team already trusts — lands a time-bounded extract on an IT store. The agent reads that store and the last signed handover notes. It drafts. A human signs in the official log.

The draft is a narrative of what the extract and the previous notes contain. It is not a diagnosis that overrules the panel. It is not a work permit. It is not a clearance to start a job.

When the copy is stale, the draft must say the copy is stale. A fluent story from yesterday's tags is how people get hurt.

What the composite plant did

They picked one unit, not the station. They used the existing twelve-hour paper log headings as the template. They forbade free chat in the control room; the UI was a form that emitted a draft into the e-log after the outgoing engineer clicked accept.

They kept names of contractors and injured persons out of the model path unless the safety workflow already required them, and then only as the safety system already stored them — not as prompt paste.

They ran thirty days of shadow drafts beside the handwritten log. They measured invented equipment tags and missing permits. They did not measure user delight.

Failure modes that matter more than BLEU

• Invented tag numbers that look real.
• Silence about a permit that expired mid-shift because the permit system was not in the copy.
• A draft that sounds certain when the extract was incomplete.
• An operator pasting the draft into a group chat that includes vendors.
• A helpful connector added later to query live tags.

Who signs, still

The outgoing engineer signs. The incoming engineer acknowledges. The agent is not a third officer. If the standing order requires a shift-in-charge countersignature, keep it.

If the model is down, the paper log remains the procedure. Write that. Test it on a day you chose, not on a trip night.

Objections you will hear — and what to do with them

These are the lines that stall the file. Answer them in the room, then put the answer in the note.

If it cannot see live tags it is useless

Then keep handover human. A delayed copy is useful for narrative. Live control is not the job. Usefulness that crosses the air gap is not usefulness.

Other plants are doing copilots on the panel

Other plants' brochures are not your standing order. Ask their OT lead, not their vendor.

We will put it on the engineering workstation only

The engineering workstation is still OT-adjacent. Do not casually install a chat runtime there. Read the OT piece.

[Union](/blog/psu-union-concerns-about-automation) will never accept a draft

Then shadow longer and keep the signature human. A draft that reduces missed remarks can be a safety aid. A draft that replaces a person will be fought, correctly.

Four weeks on one unit, shadow only

1. Week 1: sit the night shift. Copy the real headings. Draw the one-way path with OT. If they will not sign the drawing, stop.
2. Week 2: land the copy on IT. Build the form UI. No free chat. No tools toward OT.
3. Week 3: shadow drafts. Count invented tags and missing permits. Kill the corpus that causes them.
4. Week 4: write the standing order: accept control, stale-copy banner, paper fallback. Only then ask to replace the torn sheet, not the engineer.

How this shows up in the file

Subject: Shift-handover drafting agent — IT-side only.

Any handover assistant shall read a one-way, time-bounded copy and prior signed notes. It shall not connect to OT networks or write set-points, acknowledgements or permits. The outgoing engineer remains the author of the official log.

A stale-copy warning is mandatory. This note is an internal aid. It is not a safety case and not legal advice.

Why free chat fails at night

A blank prompt box invites diagnosis. Diagnosis is not the standing order. A form with official headings invites a complete log. Design the UI as a clerk, not as an oracle. Night shift will use whatever you put next to the kettle.

Prcept AI will not take a historian login. We will draft from the copy OT already signed. If that is not enough ambition for the slide, the slide was the hazard.

Permits are not narrative

A handover that forgets an expired permit is more dangerous than a handover that forgets a vibration adjective. If the permit system is not in the one-way copy, the draft must list that gap in bold. Do not let the model infer that a permit 'is probably still valid' because the previous note mentioned it.

Incoming engineers will ask the box 'what should I do first'. That question is a diagnosis. The form should not accept it. The standing order already says who walks the unit. A chat answer that invents a first job is an unauthorised work instruction. Kill that intent the way you kill set-point write-back.

If two units share a tea room, they still do not share a handover corpus. A unit 2 story in a unit 1 log is how people line up at the wrong pump. Split the copy at the same boundary OT already uses for the panel.

This article is informational field guidance for Indian public institutions, not legal, procurement, security-accreditation, engineering or board advice. Confirm against the live Gazette, GFR, GeM term, CVC instruction, CERT-In direction, UIDAI regulation, DPE guideline, DPDP text, departmental charter, plant safety manual and your counsel before you file it.

How this clears vigilance and the board

A P1 CIO/CTO in a PSU will meet CVC-shaped questions even when there is no special 'AI circular'. “Shift-Handover Agents for Plant Operations” has to survive a technical committee, a cost centre, and a union conversation if jobs appear threatened.

The useful handover agent is a clerk with a good memory of the last twelve hours of IT-side notes. It is not a control-room operator. OT networks stay off-limits. Navratna autonomy speeds buying; it does not waive DPDP or data classification. IREPS is not GeM. RBI-shaped rules still localise payment data.

• Classify data before the POC.
• Keep agents off OT.
• Write the board memo with residual risk.
• Engage unions on retrieval vs replacement.

Close this loop before the next CAB

Put “Shift-Handover Agents for Plant Operations” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “plant shift handover automation” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What must be true before you file this

If “Shift-Handover Agents for Plant Operations” is only a heading, it will not survive a file inspection. A P1 CIO/CTO should be able to attach one artefact that proves “plant shift handover automation”: a log export, a clause, a scored row, a dated notice, or a refusal rule.

Write three dated sentences: what was decided, who owns it, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the owner of “plant shift handover automation” inside the institution.
• Attach one artefact a stranger can open next year.
• Revisit when the model, the notice, or the SI changes.
• Do not treat a vendor slide as evidence.

What the next file must contain

“Shift-Handover Agents for Plant Operations” earns a line in the noting only if a P1 CIO/CTO can attach proof of “plant shift handover automation.” A heading is not proof. A vendor slide is not proof. A workshop photograph is not proof.

Write three dated sentences: what was decided, who owns it after the next posting order, and when it will be re-checked. If you cannot write the three sentences, you are not ready to buy, to sell, or to go live.

Leave unsourced percentages out of the note. DPDP is not a blanket localisation statute. The November 2025 AI governance text is guidance, not an Act. CERT-In’s 28 April 2022 directions still set specified incident and log clocks. A PAC, when lawful, lives in GFR Rule 166.

• Name the designation that owns “plant shift handover automation.”
• Attach one artefact a stranger can open next year.
• Record the instrument you are actually using.
• Revisit when the model, the SI, the notice or the posting changes.