A machine can close the act on kilograms. It cannot own the refusal. The stop has to live in a person who can halt the arm — not in a committee that sees the cell once a quarter.
The machine is good at the doing. Reach, place, weld, carry. That is operative work. It can run at a tempo no person should be asked to match.
What it cannot do is the other job: look at a high-scoring move and still say no. Give a reason that is not a number. Carry the name that will be asked for after the act. That is evaluative work. It does not travel down the arm.
Plants already knew this before anyone put a model on a gripper. They just used older words for it.
The cord is not a notification
At Toyota, the andon is often told as a myth: anyone can stop the factory. The working version is smaller and more serious.
A team member who sees an abnormality pulls the cord. The line usually keeps moving. A yellow light names the station. The team leader has until the end of that cycle — often seconds, not minutes — to arrive and clear the problem. If they cannot, the line stops at a fixed position. Most pulls never become a stop. The ones that matter do.
Liker and Meier describe it without romance. The cord is not a slogan about empowerment. It is a short window in which a named person has to show up, see the object, and either fix it or let the line halt. Harada, who lived with the first machining andons at Honsha, put the signal in one sentence: the machine is calling us for help.
That is above the loop on a shop floor. Not a dashboard. Not a quarterly safety review. A person who can still change the next act.
Jidoka said the same thing from the other side. Equipment should stop itself when it sees an abnormality. People should have the same right when they see one that the equipment cannot. Two authorities. One purpose: do not pass the defect, and do not pretend a light is the same as a stop.
What the accidents keep repeating
The pattern in the old files is almost dull, which is why it keeps happening.
Robert Williams, Ford’s Flat Rock casting plant, January 1979. The retrieval system stalled. He climbed in to get the parts. No reliable way kept the machine inert while a person stood in its path. It restarted. He was the first recorded industrial-robot fatality in the United States.
Baunatal, June 2015. A contractor in his early twenties was inside the working space of a stationary assembly robot that had not yet been handed over to Volkswagen. The robot grabbed him and crushed him against a plate. Another contractor stood outside the cage and was unharmed. Volkswagen said it was human error, not a machine fault. The machine did what machines do when the conditions for motion are met. The person who needed to stop it was in the wrong place, or the halt wasn’t his to give.
OSHA’s casebook is the same story in different plants. A programmer who did not know the next motion. A colleague who restored power while someone was in the cell. A worker who cleaned a photocell in automatic mode; the beam returned, the arm continued, the person was still there. Japanese labor files add the everyday version: interlocks lifted “just for a minute” during changeover; the upstream condition came true; the equipment moved.
On 31 October 2025, in Singapore, a worker adjusting a crate of dishes at the end of a conveyor was pinned by the arm of a semi-automated washer. The arm had no presence sensor. She was standing in its zone. She died the same day.
None of these are stories about a robot that “decided.” They are stories about motion without a person who could see the object, halt the act, and be found afterward.
Two conditions that do not sit in a binder
Santoni de Sio and van den Hoven gave the job two tests that still fit a cell.
Tracking. The system has to answer to the reasons the people who put it there gave it, and to the facts in the room. If the person at the gate cannot say what the firm will not do when the score looks good — off-sequence kit, unverified part, person in the envelope — tracking has already failed.
Tracing. Every outcome has to lead back to a human who understands what the system can do and knows others may hold them responsible. If technical knowledge lives in engineering and moral ownership lives in a committee that never sees the queue, tracing has failed. Both have to live in the same named person, or the same small named group on the shift.
A safety committee that signs the cell in January and visits in October is not tracing. It is a photograph of control.
Four more tests sit on the person, not the poster. They need the power to halt, change, or override — a comment in the MES is not that. They need to see the object and the state, not a confidence score. They need to be able to not click through when the line is loud. They need to be there to oversee, not to clear a queue measured on cycle time.
Take one away, and you still have a human in position. You do not have control.
The plant will staff the gate cheaply
A factory’s immune system is older than the office one. It will put whoever is easy to roster at the pendant. It will measure them on uptime. It will call the quarterly review “human in the loop.”
That is how you get signatures and still ship the wrong pack. Or worse.
A Korean industrial-safety group said the quiet part in September 2026, as generative models and moving machines arrived on the same floor: decide in advance who stops the robot, and who is allowed to start it again. Do not leave that to the moment. Do not leave it to a sensor that says the path is clear.
The same rule applies when the proposer is a model. Fluency is not a reason. A high score on an off-distribution grasp is still a grasp. Calibrated distrust is the job: form a view of the case apart from the machine’s rationale. Competent people accept bad advice from systems they have found reliable. Accountability and a look at the actual part reduce that. IQ does not.
What this does to the first twin
The Evolut path already puts a person on every material decision. On a line, the last step is motion. So the gate cannot be a visitor.
The team leader who already owns the zone is the natural name — if they can see the object, reach the stop, and are measured on the quality of the refusal, not only on takt. The integrator who leaves after commissioning is not that name. A “digital factory” inbox is not that name.
Write it in the mandate before the arm is powered:
• Who may halt.
• Who may restart.
• What must be true of the object before the next move.
• How the chain is reconstructed on a Tuesday afternoon: who authorized, on whose behalf, with what privilege, what the thing actually was.
If that pack cannot be read in ten minutes and enforced on a shift, it is not a mandate. It is a press release.
Learn only from events that touched the part. A clean pick of a cloned serial is not a win. If the reader is down, the workflow stops. Inference of safety from a complete passport is a story. Stories are how people end up in the envelope.
Do not promote the junior
A body is reach. A model is a proposer. Neither sits above the loop.
The loop can close on kilograms. The refusal cannot. Tracking, tracing, a hand on the stop, and a reason that survives the incident review — those stay with a person who can still see the station.
Toyota already built the short window. The accidents already named the cost of skipping it. Staff the gate as a job. Train it on the ways the cell fails. Measure informed refusal. Put a name on the act.
Above the loop is not a temperament. It is a person who can halt the arm.