Who Gets to Pull the Cord?

The central weakness in most Process Safety Management programs is not a lack of rules or documentation. It is that the people who design, approve, and override the program's requirements are structurally insulated from the consequences those requirements produce when they meet actual work. Operators bear both the safety exposure and the labor of execution under real conditions. When a requirement proves mismatched, the friction surfaces first on the floor, yet the authority to act decisively often sits elsewhere. The floor knows first. The org chart hears last.

This is the opposite of “skin in the game.”

Ancient Rome understood the principle viscerally. Roman engineers were sometimes required to stand under the arches they had designed while the temporary supports were knocked away and the full load was applied for the first time. Imagine the creak of stone, the dust in the air, the engineer’s heart pounding as he stood there — knowing that if the structure failed, he would be crushed alongside anyone else nearby. No distance. No committee. No insurance policy after the fact. The arrangement forced accountability at the exact point where elegant design met unforgiving physical reality.

Modern industry rediscovered this wisdom in motion. Toyota’s Andon system lets any worker pull the cord and stop the entire production line the moment something feels wrong. Production halts immediately. A supervisor must come to the station. Override is not issued from a distant office; it requires presence and engagement with the very condition that triggered the stop. The person with authority cannot remain insulated from the person who first encountered the problem.

Yet most current PSM programs operate on the opposite principle.

Operators are responsible for carrying out the program's requirements under real conditions. When a procedure, management-of-change expectation, training demand, or integrity task cannot be executed safely or practically as written, the operator sees it first. Raising the issue typically initiates reviews and approvals that occur away from the work. By the time anyone with decision authority engages, context has been lost. The program can appear compliant on paper while growing more brittle in practice.

The fix operates at two connected levels.

At the floor, operators need clear, protected authority to halt the specific task or procedure they are executing when it presents unacceptable safety risk or when the prescribed method cannot be fulfilled safely under the conditions present. Protected means no retaliation and no management friction for using it. This is not a suspension of the PSM program — it is an immediate intervention that prevents harm or unsustainable execution from continuing.

A live hazard gives an operator something to stand next to. A downplayed line in a process hazard analysis does not. Add a new field to the risk matrix: not just severity and likelihood, but risk to whom — naming the specific role exposed in that scenario. Once a name or role sits in that column, the ranking stops being abstract. Whoever is named gains standing to challenge it.

If the operator who would actually be there believes the severity is downplayed, it becomes a formal objection. The ranking changes, or someone must sign their name to the reason it stays. Unanswered objections escalate automatically and become part of the permanent record.

This structure reduces fragility and introduces antifragility. Every documented halt reveals exactly where requirements diverge from reality. The organization gets stronger from facing those gaps instead of hiding them until catastrophe forces the conversation.

Objections will focus on production pressure and too many halts. These concerns are real. But suppressing every visible interruption only lets problems compound underground. Production that depends on hidden burdens and deferred risk is not sustainable — it is fragility wearing the mask of order.

A pilot on a single unit can prove the concept. Measure success not by fewer halts, but by how much more accurate and alive the PSM program becomes.

We do not improve PSM by adding more layers between those who bear the consequences and those who write the rules. We improve it by making sure that when reality diverges from the paperwork, the divergence is met with eyes on the work and skin in the decision.

The Roman engineer under the arch understood this. The Toyota worker with the cord lived it every day. The best PSM programs will be those that finally bring the two closer together.