Andon line-stop escalation & MTTR records: govern micro-stop filtering, tiered response SLAs, and 5-Why reason codes

When a manufacturing plant installs an Andon board or MES downtime screen without governing escalation tiers and reason-code ownership, two failure modes quickly paralyze continuous improvement. First, pulling the Andon cord turns on a stack light that nobody answers for 14 minutes because there is no automated paging SLA or physical badge-in acknowledgement—so operators stop pulling the Yellow cord early and wait until the line crashes into a full Red stop. Second, when the machine is finally ready to restart, the HMI demands a mandatory "Root Cause Code" before the operator can press Cycle Start.

Hurried to get the line moving, and lacking diagnostic knowledge of why a servo drive faulted, the operator clicks the first button on the touch screen ("01 - Mechanical" or "99 - Other"). At month-end, management looks at a Pareto chart claiming $68%$ of downtime was "Other", while $25%$ of shift capacity lost to 15-second nut-runner and bowl-feeder micro-stops was never recorded at all.

The direct solution is to build an event-driven Andon escalation and two-stage downtime governance workflow inside the MES and CMMS. Distinct from M031 (which covers the mathematical formulation of Overall Equipment Effectiveness $\text{OEE} = \text{Availability} \times \text{Performance} \times \text{Quality}$), this guide (M121) specifies real-time tiered escalation SLAs, badge-verified MTTA/MTTR clock splitting, PLC micro-stop clustering rules, and two-stage symptom-to-root-cause closure workflows.

Scope and safety boundary

This article defines the MES, Andon paging, PLC telemetry, and CMMS record architecture for shop-floor stoppage escalation, response-time measurement, and downtime reason-code governance:

• What this workflow governs: Routing Yellow/Red Andon calls across functional responder tiers (Team Lead - over Maintenance / Quality / Material Handler - over Area Manager), splitting total downtime into response wait ($\text{MTTA}$) vs active resolution ($\text{MTTR}_{\text{active}}$), aggregating sub-minute PLC micro-stops, and enforcing two-stage reason-code verification.
• What this workflow does not replace: Software Andon workflows never replace hardwired safety-rated Emergency Stop (E-Stop) circuits, light curtains, or Lockout/Tagout (LOTO) procedures governed by ISO 13849 / IEC 62061 and OSHA/statutory machinery safety laws. Physical safety interlocks must always act directly through safety relays/PLCs independent of the MES network, and no software escalation timer or remote acknowledgment may ever re-energize or restart a line.

Bounded shop floor andon escalation software verification and exception-routing workflow

Follow the workflow below, or open its complete text version.

Read the complete workflow as text

1. Capture shop floor andon escalation baseline record → Verify revision, unit Basis and cutoff alignment
2. Verify revision, unit Basis and cutoff alignment → Run deterministic reconciliation and tolerance check
3. Run deterministic reconciliation and tolerance check → Quarantine mismatched or unapproved lines
4. Quarantine mismatched or unapproved lines → Route exception to named domain and finance owner
5. Route exception to named domain and finance owner → Release verified record with immutable audit trail

Designing the four-pillar Andon and downtime governance engine

1. Fixed-position Yellow-to-Red escalation and MTTA vs. MTTR clock splitting. Under Toyota / Lean Jidoka principles and ISO 22400-2, an Andon pull should not immediately freeze the entire conveyor at $T = 0\text{ seconds}$ (unless it is a safety hazard or severe tool crash).

1. Yellow Call (HELP_WITHIN_TAKT): When an operator encounters a cross-threaded fastener, missing part, or gauge discrepancy at $T = 18\text{ s}$ into a $60\text{-second}$ Takt cycle, pulling the Yellow cord alerts the Team Lead immediately. The Team Lead has the remaining $42\text{ seconds}$ before the carrier reaches the Fixed-Position Stop Line to assist and clear the issue with zero line-stop downtime.
2. Red Fixed-Position Stop & Tiered SLA Timers: If the issue is still unresolved when the carrier reaches the station exit ($T = 60\text{ s}$), the PLC halts the line smoothly at the fixed position and initiates the Red Line Stop clock:
   • $\text{MTTA}$ (Mean Time To Acknowledge): Runs from $t_{\text{stop}}$ until the dispatched specialist (Maintenance Technician, Quality Engineer, or Water-Spider Material Handler) physically scans their RFID/NFC badge at the faulted station HMI ($t_{\text{ack}}$). Remote acknowledgment from a maintenance office desk is prohibited.
   • $\text{MTTR}_{\text{active}}$ (Active Repair / Resolution Time): Runs from badge-in ($t_{\text{ack}}$) to line restart ($t_{\text{restart}}$).
   • Total Resolution Time ($\text{MTTR}_{\text{total}}$): $$\text{MTTR}{\text{total}} = \text{MTTA} + \text{MTTR}{\text{active}} = (t_{\text{ack}} - t_{\text{stop}}) + (t_{\text{restart}} - t_{\text{ack}})$$

2. Automated PLC micro-stop clustering ($5\text{ s}$ to $59\text{ s}$). Manual operator logging completely misses micro-stops (short stoppages lasting $5\text{ to }59\text{ seconds}$, such as vibratory bowl-feeder jams, vision-camera glare re-reads, or pneumatic clamp bounce). Conversely, forcing an operator to select a reason code on an HMI after every 12-second pause creates a longer delay than the micro-stop itself! Configure the PLC/MES interface with a Two-Threshold Micro-Stop Rule:

• Sub-Minute Auto-Log ($5\text{ s} \le \Delta t under 60\text{ s}$): The PLC automatically logs the exact fault bit (e.g., PLC_FAULT_408: Nut-Runner Spindle #2 Torque Low Retry) and duration into the MICRO_STOP_LEDGER without locking the HMI or requiring operator text entry.
• Chatter Escalation Trigger ($\ge 5\text{ repeats in }60\text{ min}$): If the same PLC fault bit fires $\ge 5\text{ times}$ within a rolling $60\text{-minute}$ window (or accumulates $\ge 180\text{ seconds}$ of micro-stop loss in an hour), the MES automatically fires a Tier-1 Yellow Maintenance Alert and generates a corrective work order.

3. Two-stage reason-code governance (Symptom at Restart vs. Root Cause within 24h). To keep line restarts fast while ensuring accurate engineering pareto data (AIAG CQI-20) and clean ERPNext Downtime Entries:

• Stage 1 (At Line Restart — Operator / Responder): Select a deterministic 3-Level Symptom Tuple (Station/Asset $\rightarrow$ Component Group $\rightarrow$ Observable Symptom, e.g., STN-04 - over Nut-Runner #2 - over Torque Angle Fault). No "Other" option exists; if a symptom is genuinely missing, selecting PROVISIONAL_NEW_SYMPTOM allows immediate restart and flags the Manufacturing Engineer.
• Stage 2 (Within 24 Hours — Maintenance / Quality Owner, mandatory for any stop $\ge 10\text{ min}$ or chronic micro-stop cluster): The accountable engineer must append the Verified Technical Root Cause (e.g., RC-MECH-14: Worn Socket Hex Allowing Fastener Cam-Out) and link the preventive action or 5-Why record before the shift downtime ledger can close.

under div over under table over under thead over under tr over under th over Escalation Tier under /th over under th over Trigger Threshold under /th over under th over Primary Notified Role under /th over under th over Required Physical / System Action under /th over under th over Governance Escalation if SLA Breached under /th over under /tr over under /thead over under tbody over under tr over under td over under strong over Tier 0: Yellow Help Call under /strong over under /td over under td over $T = 0\text{ s}$ (Within Takt cycle) under /td over under td over Cell Team Lead (Zone 1) under /td over under td over Arrive at station within $20\text{ s}$; assist operator to clear issue before Fixed-Position limit under /td over under td over Auto-converts to under strong over Tier 1 Red Line Stop under /strong over at Fixed-Position Takt boundary ($T = 60\text{ s}$) under /td over under /tr over under tr over under td over under strong over Tier 1: Red Line Stop under /strong over under /td over under td over $T = 0\text{ s}$ of Red Stop under /td over under td over On-Shift Maintenance / QE / Material Handler under /td over under td over Physical NFC badge-in at station HMI within $\text{MTTA}_{\text{SLA}} \le 2.0\text{ min}$ to stop wait clock under /td over under td over If no badge-in by $2.0\text{ min}$, page Shift Supervisor and Maintenance Dispatcher under /td over under /tr over under tr over under td over under strong over Tier 2: Extended Stop under /strong over under /td over under td over Red Stop $\ge 5.0\text{ min}$ under /td over under td over Maintenance Lead & Production Supervisor under /td over under td over Join station triage; verify spare-part availability or initiate quality containment sort under /td over under td over Mandatory Stage-2 Verified Root Cause & CMMS Work Order required at $\ge 10.0\text{ min}$ under /td over under /tr over under tr over under td over under strong over Tier 3: Critical Line Stop under /strong over under /td over under td over Red Stop $\ge 15.0\text{ min}$ under /td over under td over Value Stream / Plant Manager & Eng Lead under /td over under td over Convene line-side war room; evaluate customer shipment buffer & formal 5-Why / 8D under /td over under td over Lock shift signoff until Stage-2 5-Why countermeasure is approved by Engineering under /td over under /tr over under /tbody over under /table over under /div over

Illustrative worked example: 12-station axle assembly shift Andon, MTTA/MTTR, and micro-stop audit

All figures below are illustrative and synthetic. Consider a 12-station rear-axle assembly line (LINE-AXLE-02) operating a $450.0\text{-minute}$ net shift at a $60\text{-second}$ Takt time ($450\text{ axles/shift}$ target capacity).

Step 1: Evaluate Yellow Andon saves vs. Red Fixed-Position Line Stops.

During the shift, operators and station sensors trigger $14\text{ Yellow Andon Help Calls}$ plus $2\text{ immediate Red Stops}$:

• Of the $14\text{ Yellow Calls}$, Team Leads arrive within an average of $14\text{ seconds}$ and resolve $11\text{ calls}$ before the carrier reaches the Fixed-Position Stop limit: $$\text{Yellow-to-Red Containment Rate} = \frac{11\text{ resolved within Takt}}{14\text{ Yellow pulls}} = 78.57%\text{ line-stop avoidance}$$
• The remaining $3\text{ Yellow Calls}$ cannot be cleared within Takt and escalate into Red Fixed-Position Line Stops, joining the $2\text{ direct Red Stops}$ for a total of $N_{\text{red}} = 5\text{ Red Line Stop events}$.

Step 2: Decompose the 5 Red Line Stops into MTTA (wait) and Active MTTR (repair).

Across the $5\text{ Red Line Stops}$, station NFC badge-in scans and restart timestamps show:

• Total Wait for Responder Badge-In ($\sum \text{MTTA}$): $1.5 + 2.2 + 1.8 + 2.5 + 1.5 = \mathbf{9.5\text{ minutes}}$ $$\text{MTTA} = \frac{9.5\text{ min}}{5\text{ stops}} = \mathbf{1.90\text{ minutes/stop}}\quad (18.63%\text{ of Red stop duration})$$
• Total Active Wrench / QE Resolution Time ($\sum \text{MTTR}_{\text{active}}$): $6.5 + 14.8 + 4.2 + 11.5 + 4.5 = \mathbf{41.5\text{ minutes}}$ $$\text{MTTR}_{\text{active}} = \frac{41.5\text{ min}}{5\text{ stops}} = \mathbf{8.30\text{ minutes/stop}}\quad (81.37%\text{ of Red stop duration})$$
• Total Red Line-Stop Downtime: $9.5 + 41.5 = \mathbf{51.0\text{ minutes}}$ ($\text{MTTR}_{\text{total}} = 51.0 / 5 = \mathbf{10.20\text{ minutes/stop}}$).

Step 3: Add PLC auto-captured micro-stops ($8\text{ s}$ to $59\text{ s}$) to reveal true shift loss.

While manual clipboards only recorded the $51.0\text{ minutes}$ of Red stops, the PLC cycle-overrun logger automatically captured $38\text{ micro-stops}$ ($8\text{ to }59\text{ seconds}$ each, averaging $30.0\text{ seconds/event}$) totaling $1,140\text{ seconds} = 19.0\text{ minutes}$—including a cluster of $19\text{ micro-stops}$ ($9.5\text{ minutes}$) on Station 07's retainer-clip feeder that crossed the $\ge 5/\text{hour}$ threshold and auto-triggered a maintenance adjustment:

Independent arithmetic verification.

1. Yellow containment: $11 / 14 = 78.571%$; $3$ escalated Yellows $+ 2$ direct Reds $= 5\text{ Red stops}$.
2. Red stop decomposition: $\sum\text{MTTA} = 9.5\text{ min}$ ($9.5 / 5 = 1.90\text{ min}$); $\sum\text{MTTR}_{\text{active}} = 41.5\text{ min}$ ($41.5 / 5 = 8.30\text{ min}$); sum = $51.0\text{ min}$ ($51.0 / 5 = 10.20\text{ min}$).
3. Micro-stop share of total loss: $38 \times 30.0\text{ s} = 1,140\text{ s} = 19.0\text{ min}$; total downtime = $51.0 + 19.0 = 70.0\text{ min}$ ($70\text{ lost axles}$ at $1\text{ axle/min}$ Takt); micro-stop share = $19.0 / 70.0 = 27.14%$.

Workflow, owner roles, exception handling and recovery controls

Bounded pilot and implementation check

Pilot tiered Andon escalation, NFC badge-in MTTA splitting, and PLC micro-stop clustering on 1 multi-station assembly line over 3 weeks:

• Pilot boundary: Configure Fixed-Position Yellow-to-Red transitions, install NFC badge readers at station HMIs to split $\text{MTTA}$ from $\text{MTTR}_{\text{active}}$, remove "Other" from the HMI reason tree, and enable automatic PLC logging for $5\text{–}59\text{ s}$ micro-stops.
• Acceptance tests:
  • ACT-M121-01 (Fixed-Position Yellow-to-Red Transition): Pull a Yellow Andon at $T = 15\text{ s}$ into a $60\text{ s}$ Takt cycle; verify the line continues moving until $T = 60\text{ s}$ and only halts if uncleared at the Fixed-Position boundary.
  • ACT-M121-02 (Badge-Verified MTTA vs MTTR Split): Trigger a Red stop, wait $90\text{ seconds}$ before scanning a Maintenance NFC badge at the station, and restart $240\text{ seconds}$ later; confirm the MES logs $\text{MTTA} = 1.50\text{ min}$ and $\text{MTTR}_{\text{active}} = 4.00\text{ min}$.
  • ACT-M121-03 (Sub-Minute Micro-Stop Auto-Clustering): Simulate $6$ feeder pauses of $22\text{ seconds}$ each within 40 minutes; confirm zero operator HMI popups occur on Pauses #1–#5 and an automated maintenance alert fires on Pause #6.
  • ACT-M121-04 (Zero 'Other' Bucket Enforcement): Verify that $100%$ of stops $\ge 10\text{ minutes}$ require a Stage-2 Maintenance/QE root-cause code before closing and that PROVISIONAL_UNCLASSIFIED_24H items expire into the engineering review queue.

Next actions

1. Delete "Other" and "Miscellaneous" from every shop-floor downtime screen: Replace them with a 24-hour provisional queue owned by Manufacturing Engineering so missing failure modes are properly added to the taxonomy.
2. Require physical NFC badge-in at the faulted station to stop the $\text{MTTA}$ clock: You cannot tell whether a 12-minute downtime event is a slow-response staffing problem ($\text{MTTA} = 9\text{ min}$) or a complex mechanical repair ($\text{MTTR}_{\text{active}} = 11\text{ min}$) without station badge-in timestamps.
3. Let the PLC log $5\text{–}59\text{ second}$ micro-stops automatically: Stop asking operators to type reason codes for 15-second pauses; read the PLC fault bit directly and trigger maintenance when a fault repeats $\ge 5\text{ times/hour}$.
4. Separate Stage-1 Restart Symptoms from Stage-2 Verified Root Causes: Let the line restart immediately on an observable symptom code, and require Maintenance or Quality to sign off the true engineering root cause on major stops within 24 hours.

Frequently Asked Questions

How should assembly plants structure Andon cord pull tiers (Team Lead - over Maintenance/QE - over Plant Manager), micro-stop vs line-stop thresholds, and mandatory root-cause closure codes?.

Teams should govern shop floor andon escalation software by linking every transaction to its source evidence, timestamp, and assigned owner before permitting downstream posting. Distinct from M031 (OEE calculation accuracy); M121 governs the real-time escalation clock, preventing operators or supervisors from clearing safety/quality Andon holds without verified containment. Rather than relying on informal spreadsheet overrides, the workflow enforces a documented verification gate and preserves the original observation whenever a correction is recorded.

How does shop floor escalation software handle exceptions and mismatches?.

When a discrepancy occurs during shop floor escalation software, the system routes the blocked record into an owned exception queue rather than silently dropping or auto-adjusting the balance. Assigned operational, quality, and finance owners must review and approve exceptions before posting. Each exception retains the original quantity, date, and counterparty reference until the designated reviewer resolves the variance with supporting evidence.

What should teams test before automating manufacturing downtime tracking?.

Before scaling manufacturing downtime tracking, run a bounded pilot using historical records that include partial receipts, late updates, duplicate messages, and rejected lines. Verify that the integration preserves idempotency, maintains a clear segregation of duties between operational entry and financial approval, and produces an auditable trail for every state transition.