LinkedIn has a genre of infographic that's very popular right now… that's mostly right. You've perhaps seen them. A clean illustration of a Toyota assembly line, a worker reaching up for a cord, and a caption along the lines of: “At Toyota, ANY worker can stop the ENTIRE factory.” It usually gets a few hundred likes. The comments fill up with admiration, and rightfully so.
One example:
I don't want to be the pedant in the replies. Well, OK, I do fall into that trap, I'll admit. The spirit of these posts is right, and the part they get right is the part that actually matters. But the mechanics are wrong in two specific ways, and those errors lead people to build the wrong thing when they go home and try it.
So let me take the two claims apart, because the details change what you'd actually design.
Pulling the Cord Does Not Stop the Line Every Time
Here's the first surprise. When a team member pulls the andon cord, the line usually keeps moving.
Liker and Meier describe this plainly in The Toyota Way Fieldbook. Pulling the cord sounds an alarm and turns on a yellow light. The line continues to the end of the work zone — a point they call the “fixed position stop.” There's a short window, maybe 5 to 30 seconds, between the pull and the actual stop. In that window, the team leader can respond. If the leader gets there, sorts out the issue, and pulls the cord again before the line reaches the fixed position (at the end of the cycle time), the line never stops at all. The andon goes back to green. Nobody downstream gets resynchronized. Most problems get handled this way.
The line only stops — andon turning red — if the leader doesn't reach the station in time, or decides the problem is bad enough to warrant it.
Read more: The Most Misunderstood Role in the Toyota Production System
That window is the whole thing. The cord isn't an immediate kill switch. It's a call for help with a built-in response time. And that response time only works if there's a team leader close enough, and free enough, to come running. Toyota didn't bolt that capability on. They built process stability first, so the line wasn't stopping constantly, and they invested in a team leader structure that could answer the call almost instantly. Liker and Meier are explicit that you should not implement stop-the-line until that support structure exists. Put andon cords on an unstable process with no one to respond, and you overload the help system and things unravel fast.
I've seen the unstable version. A hospital installs a “stop the line” patient safety mechanism, then routes it to an email inbox or a phone line that sometimes goes to voicemail. That's not andon. Andon requires someone to actually come. Quickly.
The Whole Factory Doesn't Stop Either
The second claim is the dramatic one: one worker, one cord, the entire plant grinds to a halt.
It doesn't work that way, and the reason is physical. A Toyota assembly line is very long and snakes around corners. Think of it as a series of straight segments connected by U-shaped turns. A line stop is really a line-segment stop. One segment can pause briefly without taking down the segments around it.
What makes that possible are small, defined buffers at the corners — Liker and Meier put the total at no more than about 10 minutes. A buffer absorbs a minor interruption. When one segment stops, the buffer feeds the next segment for a while, and the disruption stays local instead of cascading through the building.
There's a nice detail in the Fieldbook about why even local stops are costly. Picture traffic at a red light. When it turns green, the cars don't all move at once. They start one at a time until the whole line is rolling again. The same thing happens when an assembly segment restarts — everyone has to get back in sync, and Toyota even uses an audible alarm to signal the restart. That re-synchronization cost is exactly why the fixed-position-stop design tries to resolve problems inside the cycle time, before a stop ever happens.
So the buffers do real work. They keep one station's problem from becoming everyone's problem. The “whole factory stops” image gets the courage right and the engineering wrong.
What the Cord Is Really Asking You to Do
Here's the part that gets lost when people fixate on the line stopping.
Read the mechanics again and notice what they're built around. The 5-to-30-second window exists so a team leader can come help. The yellow light tells the leader exactly where to go. The fixed position stop buys time for a response. Every piece of the design assumes that when a worker signals a problem, someone is coming, fast, to help solve it. The Fieldbook is blunt that you need a responsive support structure with high capability before any of this works. The cord is the easy part. The structure that answers it is the hard part.
Which means the cord isn't really asking a worker to stop production. It's asking the worker to admit, out loud and in public, “I have a problem I can't solve alone.” That's a vulnerable thing to do on a factory floor (in some plants). In a lot of workplaces, raising your hand like that gets you blamed, or quietly marked as the person who slows things down.
Toyota inverted that. You don't get punished for maybe stopping the line. You get helped for pointing out a problem. You get thanked. The signal brings a team leader who comes to assist, not to scold. Over time, that changes what pulling the cord means. It stops being a confession and starts being something closer to a contribution. Amy Edmondson‘s research on psychological safety would popularize a name to this — the shared belief that it's safe to take an interpersonal risk like admitting a mistake or asking for help — but Toyota was engineering the behavior decades before the term existed.
Same Cord, Different Answer
The cleanest proof that the cord is culture, not hardware, comes from a 2007 BBC story I wrote about at the time.
Workers at Toyota's Georgetown, Kentucky plant were pulling the andon cord about 2,000 times a week. Workers at a brand-new Ford truck plant in Dearborn, Michigan were pulling it twice a week. Same country. Same kind of vehicle. Roughly the same equipment — Ford bought the cords and installed them.
Nobody believes Ford had a thousand times fewer problems. The BBC attributed the gap to “the legacy of generations of mistrust between shop-floor workers and managers.” When I later talked the story through with Jeff Liker, he added a wrinkle that makes it more useful than a simple morality tale. Ford had actually put real effort into Dearborn — worked with former Toyota people for a couple of years, created an offline team leader role to respond to andon pulls, which is structurally how Toyota makes the cord work. Then Ford Finance told the plant it would be compared to a sister plant running without that team leader structure, and that the role might be eliminated if it didn't prove its value. The old culture, Liker's read, won. His honest coda: he thinks the Dearborn approach would have worked given time and the right conditions, though he can't prove it.
If your cord gets pulled just twice a week, the comforting story is that you just don't have many problems. That's almost always the wrong story. The more likely one is that people have learned what happens when they pull the cord, and decided it isn't worth it.
So when I see one of those mostly-right infographics, what I'd want to add isn't a correction about buffers and fixed-position stops, though those are real. It's a question about the 30 seconds after the cord gets pulled. Who comes? How fast? And what's on their face when they get there?
Here's an infographic that seems more accurate, even if it's not as dramatic as “stop the whole factory!”
