§ 82
Andon (Stop the Line)
Letting anyone who sees an abnormality stop the line keeps a defect from traveling downstream, where it costs more to find and fix.
Keep in mind
Let anyone stop the line, and never punish a stop
What to do
Make a red main-branch build, a failed canary or a breached SLO halt further merges or deploys for everyone, and let anyone pull that cord without asking permission. Keep the trigger narrow enough that it rarely fires falsely, and treat a stop that nobody investigates as a defect in the response, not in the person who pulled it.
Why it happens
A defect caught where it is made has one cause and an obvious fix; the same defect found three stations later is buried under work built on top of it, and the person who could explain it has moved on. Pressure to keep the line moving makes each worker discount what they saw and assume someone downstream will catch it. Toyota's jidoka moved the decision into the station: first a loom that stopped itself when a thread broke, later a cord any operator can pull to halt the line and light the andon board. The stop is not the point; it forces the abnormality to be examined while the evidence is still fresh.
In practice
At the old GM plant in Fremont, California, which closed in 1982, workers said the rule was that the line must never stop, and one recalled that stopping it could get you fired. When GM and Toyota reopened it as NUMMI, workers got an andon cord: a pull summoned team leaders, and the line stopped only if they could not fix the problem. NUMMI's defect rate was among the best in America from the start, with near-perfect quality ratings within months of the first car in December 1984.
Read the accountWhen it stops applying
Throughput Pressure: every stop costs output, and where a team is judged on throughput, pulling the cord becomes a cost someone has to justify, so a cord that fires often or falsely teaches people to route around it.
Source
Toyota Motor Corporation, Toyota Production System (official page, global.toyota) — jidoka, the andon board and the stop cord any operator can pull, traced to the Toyoda Power Loom with a weft-breakage automatic stopping device, developed in 1896; the page credits Taiichi Ohno (1912–1990) with establishing the system and the framework of Just-in-Time.
Read the sourceCite this
Read in a column
- Before and after an incident Next in the column: Blameless Postmortem
Related laws
- 02Normalization of DevianceA broken rule that causes no immediate harm quietly becomes the new normal.
- 72Error BudgetAn SLO below 100% leaves a measurable allowance of failure, and that allowance can be spent.
- 83Five WhysThe first answer to "why did this fail" is usually a symptom, and fixing a symptom leaves the cause in place to fail again.
- 98Genchi Genbutsu (Go and See)Decisions made from reports drift away from what is actually happening, because each layer of summary drops the detail that did not fit its form.
- 113Maker's Schedule, Manager's SchedulePeople who make things need long unbroken blocks of time, and a calendar run in one-hour slots breaks those blocks into pieces too small to use.