Definition
STOP6 is a safety-management framework that identifies the six hazard sources most likely to cause a serious accident — one resulting in death or severe, lasting injury — and manages each with focused countermeasures. It was systematized at Toyota and has been widely adopted as a safety foundation across manufacturing.
Its underlying logic is one of prioritization. A factory contains an almost unlimited number of hazards, and trying to apply uniform countermeasures to all of them spreads effort too thin to be effective. STOP6 draws on accident case studies to narrow the focus to the six sources with the highest severity, and concentrates resources there — the principle that you protect life first by attacking what actually kills.
The Name
The “6” is the substantive part: the six hazard sources. The “STOP” is an English-derived label built loosely around the idea of stopping serious accidents — variously expanded in Toyota materials around “Safety,” “Toyota,” and “zero accidents.” The exact expansion is less important than the discipline it names: stop the six hazards that cause fatalities.
The Six Hazard Sources
A simple A–B–C–D–E–F mnemonic keeps all six in mind when scanning an operation:
- A — Actuator (power). Motors, cylinders, presses, robot arms — anything that generates mechanical force. Typical accidents: being caught in, drawn into, or cut by powered equipment. Most serious cases occur during non-routine work (cleaning, inspection, adjustment) when guards are removed or procedures bypassed.
- B — Block (heavy loads). Crane lifts, dies and molds, large components, heavy carts. Typical accidents: crushing, fracture, and impact from falling or overturning loads, often from rope/rigging failure or a swinging suspended load.
- C — Car (vehicles). Forklifts, tow vehicles, trucks, in-plant transport. Typical accidents: collision and being struck, especially from blind spots in reverse or pedestrians entering vehicle paths.
- D — Drop (working at height). Openings at height, ladders and stairs, scaffolds, tank tops. Typical accidents: falls causing fracture or death, from damaged handrails, unstable footing, or unplanned climbing.
- E — Electricity. Control panels, distribution boards, welders, transformers, cords. Typical accidents: shock causing cardiac arrest, burns, or muscle damage — dangerous precisely because electricity is invisible.
- F — Fire (high heat). Molten metal, high-temperature steam and oil, furnaces, welding, flammables. Typical accidents: burns, and explosion or fire.
How It Works
In daily operation, managers and supervisors are expected to ask, of any task involving equipment or materials, “Is a STOP6 hazard source lurking in this operation?” When one is found, it is addressed from two directions at once:
- Hardware (equipment) countermeasures — guards, interlocks, pedestrian/vehicle separation, lockout devices, physical barriers between people and the hazard.
- Software (procedure and rule) countermeasures — standardized work, lockout/verify-zero-voltage sequences, designated standing positions, required protective equipment.
The two are complementary: a guard can be removed and a rule can be ignored, so durable safety usually needs both. A recurring theme across all six is that familiarity breeds inattention — the most experienced workers, doing a dangerous task they have done a thousand times, are often the ones a serious accident finds.
Relationship to Hazard Prediction Training
STOP6 and KYT are the two halves of Toyota’s shop-floor safety system. STOP6 defines what the deadliest hazards are — the targets. Hazard prediction training (4R-KYT) is the method that builds each worker’s ability to notice and counter those hazards in the moment. STOP6 without KYT is a list; KYT without STOP6 lacks focus. Together they pair a clear set of priorities with a trained, hazard-sensing workforce.
Common Mistakes
Treating all hazards equally. The whole point of STOP6 is to concentrate limited attention on what kills. Diluting effort across every minor hazard is how the serious ones get missed.
Relying on equipment alone — or rules alone. Guards get removed for maintenance; rules get shortcut under time pressure. Serious-accident prevention needs both hardware and procedural countermeasures reinforcing each other.
Ignoring non-routine work. A large share of serious accidents happen not during normal production but during cleaning, inspection, adjustment, and changeover — exactly when safety devices are most likely to be temporarily defeated. These tasks deserve the most rigorous countermeasures, not the least.
Letting familiarity pass for safety. “We’ve always done it this way and no one’s been hurt” is not a control. The hazard is still there; only luck has changed.