San Francisco Marriott Marquis Hotel 55 Fourth Street City, State/Country: San Francisco, CA / USA San Francisco, CA / USA Leader(s):

Transcription

1 Background Statement for SEMI Draft Document 5000A DELAYED REVISIONS TO SEMI S2-0310e, ENVIRONMENTAL, HEALTH, AND SAFETY GUIDELINE FOR SEMICONDUCTOR MANUFACTURING EQUIPMENT Addition of Related Information to S2: Selection of Interlock Reliability Notice: This background statement is not part of the balloted item. It is provided solely to assist the recipient in reaching an informed decision based on the rationale of the activity that preceded the creation of this Document. Notice: Recipients of this Document are invited to submit, with their comments, notification of any relevant patented technology or copyrighted items of which they are aware and to provide supporting documentation. In this context, patented technology is defined as technology for which a patent has issued or has been applied for. In the latter case, only publicly available information on the contents of the patent application is to be provided. Background This Related information is been added to create awareness on the selection of the reliability of interlocks. Original also examples would be added, but because there is now a joint working commission of the standards mentioned in this RI working on examples they will be added later. Details how to design and calculate reliability of interlocks is not covered and can be found in the referenced standards. This will beaded to SEMI S2 as a delayed implementation July Review and Adjudication Information Task Force Review Committee Adjudication Group: S2 Interlock Reliability TF NA EHS Committee Date: Monday, July 9, 2012 Thursday, July 12, 2012 Time & Timezone: 3:30 PM to 5:00 PM, Pacific Time 9:00 AM to 6:00 PM, Pacific Time Location (tentative): San Francisco Marriott Marquis Hotel 55 Fourth Street San Francisco Marriott Marquis Hotel 55 Fourth Street City, State/Country: San Francisco, CA / USA San Francisco, CA / USA Leader(s): Bert Planting (ASML) Tom Pilz (Pilz Automation) Chris Evanston (Salus) Sean Larsen (Lam Research AG) Standards Staff: Paul Trio (SEMI NA) ptrio@semi.org Eric Sklar (Safety Guru, LLC) Paul Trio (SEMI NA) ptrio@semi.org This meeting s details are subject to change, and additional review sessions may be scheduled if necessary. Contact the task force leaders or Standards staff for confirmation. Telephone and web information will be distributed to interested parties as the meeting date approaches. If you will not be able to attend these meetings in person but would like to participate by telephone/web, please contact Standards staff.

2 Safety Checklist for SEMI Draft Document 5000A Title: DELAYED REVISION TO SEMI S2-0310e, ENVIRONMENTAL, HEALTH, AND SAFETY GUIDELINE FOR SEMICONDUCTOR MANUFACTURING EQUIPMENT Addition of Related Information to S2: Selection of Interlock Reliability Developing/Revising Body Name/Type: S2 Interlock Reliability Task Force Technical Committee: EHS Region: Europe / North America Leadership Position Last First Affiliation Leader Planting Bert ASML Leader Pilz Tom Pilz Automation Documents, Conflicts, and Consideration Safety related codes, standards, and practices used in developing the safety guideline, and the manner in which each item was considered by the technical committee # and Title Manner of Consideration ISO : Safety of machinery - Safety-related parts of control systems - Part 1: General principles for design (ISO :2006, IDT). ISO : Safety of machinery - Safety-related parts of control systems - Part 2: validation (ISO ). IEC 61062: Safety of machinery - Functional safety of safety-related electrical, electronic and programmable electronic control systems. EN 954-1: Safety of machinery - Safety-related parts of control systems - Part 1: General principles for design NOTE: this has been succeeded by the ISO European ATEX directive: 94/9/EC. IEC_TR_ Guidance on the application of ISO and IEC in the design of safety related control systems. SEMI S10: Safety guideline for Risk assessment and risk evaluation process. Reviewed, considered, and attempted to summarize as applied to semiconductor manufacturing equipment. Known inconsistencies between the safety guideline and any other safety related codes, standards, and practices cited in the safety guideline # and Title Inconsistency with This Safety Guideline None known None known Other conflicts with known codes, standards, and practices or with commonly accepted safety and health principles to the extent practical # and Title Nature of Conflict with This Safety Guideline None

3 Team member Name Company Bert Planting (TF-leader) ASML Thomas Pilz Pilz GmbH & Co. KG Brian McMorris SICK, Inc. Mark Fessler Tokyo Electron Contributors Name Company Eric Sklar Safety Guru Cliff Greenberg Nikon Ken Mills Estec Solutions Joe Barsky Lewis Bass Int. Sean Larsen Cymer/LAM AG Mark Frankfurth Cymer Ken Kapur KLA-Tencor Matthew Grinn TEL Shigehito Ibuka TEL Paul Kelly Estec Solutions Carl Wong AKT Debbie Sawyer Semitool/glaciere export services Lauren Crane KLA Sunny Rai Intertek Alan Crockett KLA-Tencor Ron Birrel TUV-Sud Horrey Hum ESTEC solutions Steve Baldwin Lewis Bass Sandeep Bendale Lewis Bass Raymond McDaid Lam Research Alan Krov TEL David Sexton TUV Mark Bogner TUV-Sud Kyle Lebouitz Xactix Paul Breder ESTEC solutions Byron Yakimov Cymer Ron Macklin Macklin assoc Joe Basky Intertek Samir Sleiman Chris Evanston Salus Lindy Austin Salus Alan Crocket KLA Ken Kuwatani TUV Sud Rich Petronio VEECO Ton Vang LAM

4 Nigusu Ergete Intertek/GS3 Raymond McDaid LAM Research Brian Cleas LAM research Alan Cose Intertek GS3 Peter Hsu Aixtron Paul Green Ultratech Edward karl Applied Materials

5 SEMI Draft Document 5000A DELAYED REVISION TO SEMI S2-0310e, ENVIRONMENTAL, HEALTH, AND SAFETY GUIDELINE FOR SEMICONDUCTOR MANUFACTURING EQUIPMENT Addition of Related Information to S2: Selection of Interlock Reliability DELAYED REVISIONS Z (Effective July 2015) NOTICE: This Delayed Revisions Section contains material that has been balloted and approved by the global [insert committee name] Technical Committee, but is not immediately effective. The provisions of this material are not an authoritative part of the Document until their effective date. The main body of [insert designation] remains the authoritative version. Some or all of the provisions of revisions not yet in effect may optionally be applied prior to the effective date, providing they do not conflict with portions of the authoritative version other than those that are to be revised or replaced as part of the deferred revision, and are labeled accordingly. NOTICE: Unless otherwise noted, all material to be added shall be underlined, and all material to be deleted shall be struck through. DZ-1 Addition of Related Information XX to SEMI S2: Selection of Interlock Reliability (OPTIONAL before effective date) DZ-1.1 Add new Related Information section: Selection of Interlock Reliability RELATED INFORMATION XX SELECTION OF INTERLOCK RELIABILITY NOTICE: This Related Information is not an official part of SEMI [designation number] and was derived from the work of the global [committee name] Technical Committee. This Related Information was approved for publication by full letter ballot procedures on [A&R approval date]. R1-1 Purpose R1-1.1 In the section of interlocks of this standard guidelines are given for safety interlock systems. Because new technologies are used and safety systems can be complex guidance is given to standards that might be useful. This RI explains how several different standards on safety interlocks or safety related part of control systems reliability are related, how to select a reliability level of the safety interlock or safety related part of control systems and how they determine the reliability performance. This RI also provides a comparison among the definitions of reliability levels in the several standards. R1-2 Limitations R1-2.1 This RI does not provide details of calculations that determine the reliability of a safety interlocks or safety related part of control systems. R1-3 Referenced Standards and Documents R1-3.1 SEMI Standards and Safety Guidelines SEMI S10 Safety guideline for Risk assessment and risk evaluation process Page 1 Doc. 5000A SEMI

6 R1-3.2 IEC Standards 1 IEC Safety of machinery - Functional safety of safety-related electrical, electronic and programmable electronic control systems IEC Safety of machinery - Electro-sensitive protective equipment IEC Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems R1-3.3 ISO Standards 2 ISO Safety of machinery - Safety-related parts of control systems - Part 1: General principles for design ISO Safety of machinery - Safety-related parts of control systems - Part 2: Validation (ISO ISO TR Guidance on the application of ISO and IEC in the design of safety related control systems. R1-3.4 Other Standards and Documents European ATEX directive: 94/9/EC EN Safety of machinery - Safety-related parts of control systems - Part 1: General principles for design NOTE 1: EN this has been succeeded by the ISO R1-4 Introduction R1-4.1 Safety interlocks or safety related part of control systems are used to reduce risk of harm to people. Several standards require different levels of reliability of safety interlocks or safety related part of control systems depending on the risk. Risk is evaluated on several factors like: frequency people are expected to be harmed the severity of the harm whether there is a possibility to notice the risk and avoid the harm. R There are several standards that describe the reliability of safety interlocks or safety related part of control systems. Other standards (e.g. robot standards) refer to these basic reliability standards for reliabilities. R1-4.2 This RI is limited to the selection of the reliability. Information about how reliability can be determined or calculated can be found in the referenced standards. R1-4.3 Depending on the standard the criteria for the safety interlocks or safety related part of control systems selection is based on harm to people sometimes combined with damage to equipment/installations. R1-5 Relation SEMI S10 and Interlock reliability selection R1-5.1 SEMI S10 is used for risk identification, ranking and evaluation. When there is a risk identified that needs mitigation of the risk (e.g. S10 risk-ranking is medium or higher) several options are possible (e.g. change design, add protection, use interlocks, ). If the mitigation is done by using safety interlocks or safety related part of control systems, these have to have a reliability level that is suitable for the mitigation. R1-5.2 After the mitigation has been implemented a new risk assessment to be carried out. 1 International Electrotechnical Commission, 3 rue de Varembé, Case Postale 131, CH-1211 Geneva 20, Switzerland; Telephone: , Fax: , 2 International Organization for Standardization, ISO Central Secretariat, 1 rue de Varembé, Case postale 56, CH-1211 Geneva 20, Switzerland; Telephone: , Fax: , Page 2 Doc. 5000A SEMI

7 NOTE: Reliability to be based on the risk. The standards ISO and IE61062 are 2 possible ways how to determine the reliability level. R1-6 Selection of the interlock system standard Figure R1-1 Relation SEMI S10 and interlock selection R1-6.1 Because there are many types of interlocks each standard has its own application and use. Table R1-1 Application of safety system related standards Standard Typical use Components covered remarks ISO : Safety of machinery - Safety-related parts of control systems Calculation of the reliability of individual components and a complete Interlock control systems It applies to any type of technology and energy used. (electrical, hydraulic, pneumatic, mechanical, and software.) ISO provides info how to calculate reliability of all types of components IEC 61062: Safety of machinery - Functional safety of safety-related electrical, electronic and programmable electronic control systems Calculation of the reliability of a complete Interlock control systems Electromechanical, control system Used for complete systems qualification Page 3 Doc. 5000A SEMI

8 Standard Typical use Components covered remarks EN 954-1: Safety of machinery - Safety-related parts of control systems - Part 1: General principles for design Functional Safety of Electrical/Electronic/Programm able Electronic Safety-related Systems European ATEX directive: 94/9/EC Reliability based on component reliability and architecture of the safety system Verify a control systy that uses software Defines reliability levels for components that need to be used in explosive atmospheres All electromechanical, electrical, valves, control systems PLC controlled system Special requirements for components that need to be used in explosive atmospheres R1-7 Safety-related parts of control systems selection based on ISO this has been succeeded by the ISO Used for requirements of a software control system. Mostly a safety PLC is approved based on this standard Components used in explosive atmospheres need to be CE marked R1-7.1 This standard uses a decision tree to identify a performance level for the safety-related parts of control systems design. Before the risk estimation can be done it is important to clearly understand the hazard scenario which exists if the safety function was not available (fails). Remember that risk reduction by other technical measures independent of the control system (e.g. mechanical guards, administrative controls, LOTO, PPE, etc) can be taken into account in determining PLr (required Performance Level). There are 3 parameters that the safety review team needs to know about, related to the machinery hazards during operation, maintenance and service, in order to determine the required Performance Level. Severity of the injury (S) S1: Slight, normally reversible injury S2: serious, normally irreversible injury or death Frequency or exposure to the hazard (F) F1: Seldom to less-often and/or exposure time is short F2: frequent-to-continuous and/or exposure time is long Possibility of avoidance the harm or limiting the harm (P) P1: Possible under specific conditions P2: Scarcely possible NOTE 2: Although the standard is using and/or in its definition for frequencies, the SEMI working group believes these should be: F1: Seldom to less-often and exposure time is short F2: frequent-to-continuous or exposure time is long Page 4 Doc. 5000A SEMI

9 Figure R1-2 ISO Decision Tree R1-7.2 The reliability in the ISO is expressed in performance levels (PL) a, b, c, d or e with increasing reliability. These five discrete levels (a, b, c, d and e) are then used to specify the minimum design requirements for the safety related parts of a control system (e.g. a safety interlock) to ensure they perform their function under foreseeable use / mis-use conditions. This must be done for each safety function, but remember its not just electrical interlocks, it is needed for pneumatic, hydraulic and mechanical interlocks as well : R1-7.3 The initial estimation (per Figure R1-2) of the performance level for the interlock s design is only the beginning of the total design process. The design engineer(s) must first assess how robust he/she is going to build the safety control system for mitigating the hazard as previously defined in the safety PLr. This important decision is based upon 3 things: How will the structural layout of the control system be chosen? Will the safety control system have any monitoring / fault detection? How will the component reliability requirements be chosen / met? R1-7.4 The standard introduces 4 parameters that the designers will need to know about their safety circuit / control system in order to determine the achieved Performance Level (PL): R Control System Category This is the classification of the safety architecture based on the structural arrangement of parts, fault detection and the component reliability of the parts selected. These control categories were originally defined in EN (e.g. CAT B, CAT 1, CAT2, CAT 3 and CAT4). R MTTF d Mean Time to a Dangerous Failure (in years). The MTTF d is the average time in which a failure that would lead to a dangerous situation occurs in the interlock circuit. The MTTFd is considered to be Low (between 3 to 10 years), Medium (between 10 and 30 years) or High (more than 30 Years). R DC avg Average Diagnostic Coverage (%). The DC avg is the % proportion of dangerous failures that can be detected by the safety design (SRP/CS), compared to all of conceivable dangerous failures that exist - both detectable and undetectable failures. It is determined by how frequently and accurately the system performs some self-diagnosis, and what it actions it takes if it senses something wrong. The DC is considered to be: not available (< 60%), Low ( 60% <90%), Medium ( 90% - <99%) or High ( 99% detected). R CCF Common Cause Failure. CCF can be simply thought of as an indicator of whether or not sound engineering practices were followed to ensure parallel channels of the safety interlock is not damaged by common Page 5 Doc. 5000A SEMI

10 causes. ISO uses a standard PASS/FAIL checklist is used to help designer to justify if they have included basic considerations to prevent common failures. Having technical measures for avoiding CCF is for designer justifying the SRP/CS to CAT 2, 3 or 4 architectures, but CCF is simply not relevant for single channels CAT B or CAT 1. R1-7.5 ISO then uses complex mathematical techniques with intelligent grouping to estimate the safety system achieved performance level based on these 4 basic interlock design factors. Figure R1-3 Overview of ISO Design Validation Process R1-7.6 The standard provides both a tabular (refer to Table R1-1 below) and graphical way to estimate the achieved PL of a single channel. Design validation occurs when the achieved PL is greater than or equal to required performance level (PL r.). If this is not the case, then a design modification or iteration is necessary. Table R1-2 Simplified relation between PL and Category levels Average Diagnostic coverage (DC avg ) Mean Time To dangerous Failure (MTTF d ) Low Medium High Simplified relation between the achieved PL and the other 4 design parameters Category B None None Low Medium Low Medium High a b Not covered Not covered Not covered a b b d b c c d Not covered Not covered c c d d d e Page 6 Doc. 5000A SEMI

11 NOTE 3: More detailed information about comparison between performance levels and the design parameters of the safety interlock can be found in ISO R1-8 Functional safety of safety related electrical, electronic and programmable electronic control systems selection based on IEC R1-8.1 This standard uses severity of harm (Se); and a class (Cl) for probability of occurrence of the harm. R1-8.2 Severity (Se) is divided in 4 levels, as is shown in Table R1-3 Table R1-3 Severity levels (Se) Severity level 1 Reversible: requiring first aid only Consequence 2 Reversible injury, including severe lacerations, stabbing, and severe bruises that requires attention from a medical practitioner. Reversible: requiring attention from a medical practitioner 3 Irreversible injury such that it can be possible to continue work after healing. It can also include a severe major but reversible injury such as broken limbs 4 Irreversible: death, losing an eye or limb R Class of probability of occurrence of harm (Cl) is a function of: Frequency and duration of the exposure of persons to the hazard (Fr) 7.2.2, Probability of occurrence of a hazardous event arising from human and machine behavior (Pr ) 7.2.3; Probability of avoiding the risk or limiting the harm (Av) R Frequency and duration of the exposure of persons to the hazard R Frequency and duration of the exposure of persons to the hazard is based on how often persons are exposed and the time people are exposed. Table R1-4 provides the values of Fr for various frequencies and durations R The frequency of exposures is divided into 5 levels of time between exposures R The duration of people are exposed to the hazard is divided into 2 levels: < 10 minutes per occurrence and 10 minutes per occurrence. Table R1-4 Frequency and duration of Exposure (Fr) Frequency (time between exposures) Duration < 10 Min. Duration 10 min 1 hour 5 5 > 1hour to 1 day 4 5 > 1 day to 2 weeks 3 4 > 2 weeks to 1 year 2 3 > 1 year 1 2 R Probability of occurrence of a hazardous event arising from human and machine behavior (Pr) This factor is an estimation on the behavior of the machine and foreseeable characteristics of human behavior. R The machine behavior will vary from very predictable to not predictable but unexpected events cannot be discounted. Predictability of the behavior of component parts of the machine relevant to the hazard in different modes of use (e.g. normal operation, maintenance, fault finding). R Characteristics of human behavior that to be taken in account include stress, lack of awareness. These are influenced by factors such as skills, training, experience and complexity of the machine. NOTE 4: Skills and training to be stated in the documentation for use. Page 7 Doc. 5000A SEMI

12 Table R1-5 Probability classification Probability of occurrence Probability of occurrence factor (Pr) Very High 5 Likely 4 Possible 3 Rarely 2 Negligible 1 R Probability of avoiding or limiting the harm (Av) This factor can be estimated taken into account aspects of the machine like sudden, fast or slow appearance of the hazardous event, clearances to withdraw from the hazard and nature of the system (e.g. cutting machine will have a sharp edge, heating system will have hot surfaces, ) and the possibility of recognition of the hazard (electrical hazard can only be recognized by using a meter, noise when a motor starts). Table R1-6 Probability of avoiding or limiting harm Probability of avoiding or limiting harm Probability of avoiding or limiting harm factor (Av) Impossible 5 Rarely 3 Probable 1 R Each probability functions get a rating and the class of probability of occurrence of harm (Cl) is the sum of frequency and duration (Fr), probability of occurrence (Pr) and possibility of avoidance (Av). Cl = Fr + Pr + Av (1) R The SIL requirement is given in table R1-7. Table R1-7 SIL requirement Severity Class SIL 2 SIL 2 SIL 2 SIL 3 SIL 3 3 #1 SIL 1 SIL 2 SIL 3 2 #1 SIL 1 SIL 2 1 #1 SIL 1 #1 For these levels other measures may be appropriate (e.g. PL a) R1-8.3 The calculation of the SIL levels will be based on the architecture of the design and the reliability data of the chosen components. Details can be found in IEC R1-9 Interlock selection based on EN R1-9.1 This section is for reference only because EN has been replaced by ISO R1-9.2 The hardware requirements of EN were based on hardware and fault tolerance. R1-9.3 Interlock reliability is determined in a decision diagram using severity of possible harm, frequency of exposure and the possibility of avoidance. R1-9.4 Definition of severity, frequency and possibility of avoidance are identical to the ISO (see R1-7) Page 8 Doc. 5000A SEMI

13 R1-10 Other standards that might be useful Figure R1-3 Interlock category selection based on EN R The European legislation for Explosive Atmospheres (ATEX) also defines reliability of the components which can be used in areas with an explosion risk. This risk assessment is based on substances used and time a hazardous atmosphere is present. Details on the requirements for can be found in R IEC series provides information and requirement if PLC and logic is used. Preferably a software application used in safety to be approved by a notified body against this standard. R ISO TR provides information on safety components using Electro-sensitive protective equipment (e.g. light curtains) and their relation with ISO and IEC R1-11 Comparison between the different reliability levels R The IEC_TR_ provides more information comparing the ISO and IEC and provides an introduction to calculation of reliability levels. PFH d is an estimated data point (parameter) of a subsystem that does take into account the contribution of factors such as diagnostics, proof of test interval, resistance to common cause failure and control system architecture (structure). Besides the Average Probability of a PFH d ; there are some additional estimations are still necessary to determine the achieved performance level. It is not all about probability mathematics. Table R1-8 Relationship between SIL s and Performance Levels PerformanceLevel (PL) Average probability of a dangerous failure per hour (1/h); PFH d Safety Integrity Level (SIL) a 10-5 to < 10-4 Not defined b 3*10-6 to < c 10-6 to < 3* d 10-7 to < e 10-6 to < Page 9 Doc. 5000A SEMI

14 NOTICE: (SEMI) makes no warranties or representations as to the suitability of the Standards and Safety Guidelines set forth herein for any particular application. The determination of the suitability of the Standard or Safety Guideline is solely the responsibility of the user. Users are cautioned to refer to manufacturer s instructions, product labels, product data sheets, and other relevant literature, respecting any materials or equipment mentioned herein. Standards and Safety Guidelines are subject to change without notice. By publication of this Standard or Safety Guideline, SEMI takes no position respecting the validity of any patent rights or copyrights asserted in connection with any items mentioned in this Standard or Safety Guideline. Users of this Standard or Safety Guideline are expressly advised that determination of any such patent rights or copyrights, and the risk of infringement of such rights are entirely their own responsibility. Page 10 Doc. 5000A SEMI