SEMI CoHE / Lock Out Tag Out (LOTO) White Paper

Transcription

1 SEMI CoHE / Lock Out Tag Out (LOTO) White Paper Version 12 (Updated May 2, 2017) Introduction Semiconductor manufacturing uses various types of process and metrology equipment, most of which uses more than one type of hazardous energy. By consensus of the suppliers and users of this equipment, the industry relies primarily on SEMI S2 and other documents in the SEMI Standards S series to guide the safe design of equipment. The EU s Machinery Directive White Paper I criteria are usually also applied, as are criteria derived from an understanding of various workplace safety criteria, such as the US OSHA Lockout requirements. The industry has a very strong safety record which demonstrates the effectiveness of the hazardous energy control design methodologies it uses. Providing control of hazardous energy (CoHE) for maintenance and service tasks presents a couple of challenges that are not addressed by lockout: There are some maintenance and service tasks that require hazardous energy to be present. There are hazardous energies that present risks that lockout does not address well. This White Paper has been provided to show how the semiconductor equipment industry uses both lockout and alternative methods to provide CoHE during maintenance and service. Purpose This White Paper was written to show how the means of control of hazardous energy (CoHE) specified in this Standard are typically implemented in equipment used in the manufacture of semiconductor and closely-related (e.g., LED, flat panel display) devices. The principal audience for this White Paper is designers and suppliers of equipment. Although the protection of each worker is the responsibility of that worker s employer, the equipment designers and suppliers are usually best suited, technically and logistically, to provide the means of CoHE for equipment and technical instructions for the use of those means. For other employers of personnel who perform maintenance and service on such equipment, this White Paper provides some insight into how the CoHE features and procedures may have been developed. That insight may be of use in the development of CoHE procedures that meet an employer s internal requirements and the legal requirements in each location. Definitions Control of Hazardous Energy (CoHE). The management of the risk of injury by hazardous energy. CoHE can be achieved by lockout or by alternative methods. The risks managed by CoHE includes unexpected startup and contact with hazardous energy sources. References SEMI S2 SEMI S10 Environmental Health and Safety Guideline For Semiconductor Manufacturing Equipment Safety Guideline for Risk Assessment and Risk Evaluation Process Page 1 of 14

2 SEMI S14 Safety Guidelines for Fire Risk Assessment and Mitigation for Semiconductor Manufacturing Equipment ANSI Z244.1 (2016) The Control of Hazardous Energy Lockout, Tagout and Alternate Methods CoHE Method Assignment A recommended method for determining for which hazardous energies, locations, and tasks lockout is to be assigned and to which alternative methods are to be assigned is shown in Figure 1. The paragraphs following the Figure provide guidance on various steps. Figure 1: CoHE Method Assignment Process Page 2 of 14

3 Identify Energy Supplies and Reservoirs - The identification of hazardous energies should include a systematic review of the equipment. One approach that has been used successfully is to consider each of the supplies to the equipment, including: a) Electricity b) Water c) Compressed air d) Process gases e) Liquid process chemicals and each energy reservoir in the equipment, including: a) Objects above 50ºC [Consider a better approach to word this.] b) Objects below 0ºC [Consider a better approach to word this.] c) Gas or liquid vessels (consider both mechanical and chemical energy) d) Gas or liquid piping and fittings (consider both mechanical and chemical energy) e) Capacitors f) Batteries (including those embedding in such things as UPSs) g) Mechanical energy storage devices, such as springs and compressed air tanks h) Elevation (particularly of objects that are supported by other than rigid structures) i) Permanent magnets Document the Energy Flow Path Document the path through the equipment, including devices that convert one form of hazardous energy to another, such as electric heaters (electric to thermal) and pneumatic actuators (potential mechanical to kinetic mechanical). Among the concerns are: Non ionizing radiation (e.g., static and low frequency electric and magnetic fields; microwaves; IR, visible, and UV light) Ionizing radiation (e.g., x rays, gamma rays) Compressed or pressurized fluids Moving parts Assess and Document Risks Assessing risk includes estimating the severity and frequency of harm that results from a hazard. The semiconductor industry s consensus method for assessing and ranking risk to personnel is SEMI S10. Consider each hazardous energy in a location in which maintenance or service is performed and the presence in, contact with, or proximity to, those locations of personnel performing each task. Include both the direct (e.g., contact with an energized, uninsulated electric conductor) and indirect (e.g., motion resulting from electric energy being supplied to a motor) risks. In estimating the severity and frequency of harm, consider what barriers or distance separates the worker from the hazardous energy. Consider whether the work, or the tools used to perform it, may compromise the barriers or distance. Risk Acceptability The acceptability of risk is determined by governmental regulations, industry consensus, and company policies. Page 3 of 14

4 Variations in the level of risk accepted by different governments may necessitate providing more than one method of CoHE to enable conformance with the regulations and minimization of the burden. SEMI S2 provides guidance on the industry s risk tolerance. Need for Hazardous Energies for Tasks Some maintenance and service tasks require some hazardous energy to be performed. For example, calibration of a sensor used for process control may require varying the property to be sensed through the relevant range. In such cases, isolation of the hazardous energy (part of lockout) would preclude performing the task. Contrarily, neither it being more convenient to have the hazardous energy present nor it being less burdensome not to perform lockout comprises a need to have the hazardous energy present during the task. Lockout, Alternative Methods, or Both By consensus, lockout should be used if it does not prevent performing the maintenance or service task and if it reduces the risks to personnel that result from the hazardous energy. An example of this is locking out the power to the parts handler motor while removing a broken wafer from the transfer chamber. If isolation of the hazardous energy would prevent performing a task, only alternative methods should be used. An example of this is adjusting the path of the parts handler, which can be done only if the parts handler is moving by itself. In some cases, however, lockout does not prevent performing the task and does reduces the risks, but not to an acceptable level. In such a case, both lockout and alternative method(s) should be used. An example of this is a wafer chuck that is heated by an electrical resistance element and is at 1000 ºC, one needs to lockout the power to the heaters, but the thermal energy stored in the heaters, chuck, and surrounding parts poses an unacceptable burn hazard. Inability to Achieve Acceptable Risk In some cases, the risk assessment will find that an acceptable level of risk cannot be achieved by lockout plus alternative methods (if the hazardous energy is not needed) or alternative methods alone (if the hazardous energy is needed). In such cases, either the equipment or the task must be modified to make it possible to reduce the risk to an acceptable level. Changes to the equipment can affect the risks of other tasks (including normal operation) and changes to tasks can affect the hazardous energy exposures and other risks of maintenance and service. Therefore, if any changes are made to tasks or equipment, the affected set of risk assessments should be reviewed and, if appropriate, updated. An example of this is requiring testing of the voltage on exposed incoming AC power bus bars. The equipment could be modified by providing remote test points or covers that prevent accidental contact, but allow contact with test probes. Equipment Design The CoHE method dilemma Equipment suppliers face two competing challenges: a) the need to provide identical equipment for installation in a broad variety of jurisdictions and b) the need to, without exposing personnel to unacceptable risk, minimize the time and effort needed for CoHE. To meet both of these needs, in many cases, the equipment has components and features that are used in only some jurisdictions or by some users. As space in semiconductor device manufacturing facilities, particularly in fab cleanrooms, is expensive to build and operate, there is substantial objection to the inclusion of such components. Page 4 of 14

5 Simplified, generic example of semiconductor manufacturing equipment Figure 2 shows some of the typical and relevant features of a piece of semiconductor manufacturing equipment (SME). This drawing does not represent a particular, real piece of equipment. It is a composite of several typical features and was created for the purpose of illustrating how CoHE is provided in such equipment. In order to fit the drawing on a single page, many process control components have been omitted. In this equipment, a container of wafers is placed in the load station. Under the control of its internal logic, the equipment opens the door between the load station and transfer chamber. The parts handler then extracts a wafer from the container and moves it into the transfer chamber. The door closes and the vacuum pump empties the transfer chamber. When the required pressure is reached, the door to the process chamber opens and the parts handler moves the wafer to the wafer chuck. The door closes and the process steps begin. The heater in the wafer chuck raises the wafer to the appropriate temperature, process gases and inert gases are supplied at the top of the process chamber, as is microwave energy. Process byproducts and excess gases are removed by the vacuum pump, so that the required pressure is maintained. The cooling plate removes the excess heat from the process chamber. At the end of the process, the vacuum pump empties the process chamber. The wafer is then moved back to the transfer chamber, where it is cooled, then moved to the load station. This sequence is repeated for each wafer in the container. In normal operation, this whole sequence occurs without human participation. Figure 2- see next page Page 5 of 14

6 Figure 2: Simplified, generic example of semiconductor manufacturing equipment Note: Solid lines represent single paths, such as a conductor or a pipe; dashed lines represent multiple paths, such as a multi-conductor cable or the supply and return hoses in a cooling loop. Page 6 of 14

7 Table 1: CoHE features of Figure 2 E51 through E53 Lockable switch Switch that can be locked in only the open position. Isolates the electric power feed, preventing exposure to the electrical energy and to unexpected energization of the load. For the motors and the heater, these devices are placed in the fab (for convenience of access) in the energy path between the drivers and the loads. The lockout device may be part of the switch or part of the assembly in which the switch is mounted. E54 Lockable switch Switch that can be locked in only the open position. Isolates the electric power feed, preventing exposure to microwave energy that could result from the unexpected energization of the microwave generator. Because of the difficulty of providing an isolation device for the waveguide, the power supply to the microwave generator is routed up to the fab to the switch and back down to the subfab. The lockout device may be part of the switch or part of the assembly in which the switch is mounted. IG1 through IG7 IG11 and IG12 Lockable manual inert gas valve Remote inert gas valve. Can be used to isolate the flow of an inert gas, such as helium, argon, and nitrogen. Handle can be locked only to prevent the valve being moved from the closed position to the open position. This is a normally closed valve: unless it is actuated, it is closed. Controlled by a safety PLC and used for remote lockout and for alternative methods, such as interlocks. KS1 and KS2 Keyed Switch A keyed or otherwise lockable input to a safety PLC. It is the means by which the remote lockout is activated. PG1 through PG7 IPG11 and PG12 IPG13 and PG14 Lockable manual process gas valve Remote process gas valve. Remote process gas valve. Can be used to isolate the flow of a process gas that is not inert, such as by being flammable, oxidizing, or toxic. Typical examples in the semiconductor industry are hydrogen, oxygen, and phosphine. Handle can be locked only to prevent the valve being moved from the closed position to the open position. This is a normally closed valve: unless it is actuated, it is closed. Controlled by a safety PLC and used for remote lockout and for alternative methods, such as interlocks. This is a normally closed valve: unless it is actuated, it is closed. Controlled by a safety PLC and used for alternative methods, such as interlocks. PS1 and PS2 Pressure switch Monitors the pressure between two remote gas valves. If the space between the valves is evacuated before the second valve is closed, a leak through either valve will result in a pressure increase in the space between them, indicating that at least one of the valves is no longer providing isolation. The safety PLC monitors the pressure switch and, if it detects such a valve failure, notifies the personnel relying on the protection of the remote valves. PS3 through PS6 Pressure switch Monitors the pressure between lockable manual and remote air valves. If the space between the valves is vented before the second valve is closed, a leak through the upstream valve will result in a pressure increase in the space between them, indicating that the remote valves is no longer providing isolation and that the manual valve is connected to the drive cylinder. If the manual valve is set to vent, the pressure switch may not indicate a failure of the remote valve, but that failure cannot cause the drive cylinder to move. PS7 Pressure switch Monitors the pressure in the process chamber. Through the safety PLC and PG11 and PG12, allows process gas flow only if the pressure in the chamber is below the switch setpoint. This is used to protect against delivering process gas to the process chamber under several foreseen conditions, including: an open lid (backs up the protection by AS2), leak from the chamber to the room, and loss of process pressure control (prevents reaching a high enough pressure in the chamber that an uncontrolled reaction could cause injury). V1 and V2 W1 and W2 W3 and W4 W51 and W52 Lockable manual vacuum valve Lockable manual water valve Lockable manual water valve Lockable manual water valve Used to prevent pumping on the chamber. Can be locked only in the closed position. Isolate the equipment from the facility cooling water loop. Can be locked only in the closed position. Isolate the cooling plate from the equipment cooling water loop. Can be locked only in the closed position. Isolate the equipment from the facility makeup water supply. Can be locked only in the closed position. Page 7 of 14

8 Maintenance (done to keep equipment operating properly) and service (done to repair equipment that has malfunctioned), however, do require humans. The following table lists several common maintenance and service tasks, the portions of the equipment to which human access is necessary, the hazardous energies present, and examples of how CoHE is provided to protect the personnel. The means of CoHE are presented in three different columns: direct lockout, remote lockout, and alternative methods. Table 2: CoHE means for sample tasks Task Access To Hazardous Energy Direct Lockout required Remote Lockout permitted Alternative Methods Methods: Lockout device (LD) and energy isolating device (EID), are in the same location with a direct mechanical linkage between them LD and EID may be in different locations and may be connected by a control system with adequate control reliability. Means of CoHE that do not include isolation of the hazardous energy, by either direct or remote lockout Mechanical: motion of parts handler E51 in fab or E7 in subfab KS1 opens K1 and K2 AS1 opens K1 and K2 Mechanical: Closing of door to load station A4 KS1 deactivates A12 AS1 deactivates A12 Remove broken wafer transfer chamber Mechanical: Closing of door to process chamber Chemical: opening of door to process chamber A6 KS1 deactivates A14 AS1 deactivates A14 A5 KS1 deactivates A13 AS1 deactivates A13 Inert gas feed to transfer chamber Not needed, as the flow rate is too low to cause asphyxiation in a well ventilated room with the lid open and the space is not accessible with the lid closed Entrapment: Vacuum pump starts V2 V2 (note 1) AS1 closes V2 Page 8 of 14

9 Mechanical: motion of parts handler Not applicable, as this task can be done only if the parts handler is moving by itself while being observed directly. Limiting the speed and force of the parts handler motion and providing a control to the person performing the task that must be actuated continuously for the parts handler to move. Mechanical: Closing of door to load station A4 KS1 deactivates A12 AS1 deactivates A12 Mechanical: Closing of door to process chamber A6 KS1 deactivates A14 AS1 deactivates A14 Inert gas feed to transfer chamber Not needed, as the flow rate is too low to cause asphyxiation in a well ventilated room with the lid open and the space is not accessible with the lid closed Adjusting the path of the parts handler transfer chamber Entrapment: Vacuum pump starts process gases process residue V2 V2 (note 1) AS1 closes V2 PG6 in fab or PG3 and PG 5 in the subfab KS2 closes PG11 and PG12 There s no available isolating device, so alternative methods must be used.) are needed AS2 or PS7 closes PG11 and PG12 automated purging and cleaning processes, work practices, supplemental ventilation, or PPE Thermal: chuck is heated to 1000 ºC E53 in fab or E13 in subfab (notes 2 and 5) KS2 opens K3 and K4 (notes 2 and 5) AS2 opens K3 and K4 (notes 2 and 5) Thermal: cooling plate Not needed, as the heat transfer fluid is water, as is the utility to which it transfers heat, so the minimum temperature does not comprise a touch hazard. process residue There s no available isolating device, so alternative methods must be used.) are needed automated purging and cleaning processes, work practices, supplemental ventilation, or PPE Electromagnetic: exposure to microwave energy E54 in fab or E14 in subfab. (note 3) KS2 opens K3 and K4. AS2 or PS7 opens K3 and K4 Page 9 of 14

10 Mechanical: motion of parts handler Mechanical: Closing of door to transfer chamber Mechanical: opening of door to transfer chamber Not needed, as long as the door to the transfer chamber is closed and prevented from opening. A6 KS2 deactivates A14 AS2 deactivates A14 A5 KS2 deactivates A13 AS2 deactivates A13 Mechanical: movement of wafer chuck E52 in fab or E12 in subfab KS2 opens K3 and K4 AS2 opens K3 and K4 Thermal: chuck is heated to 1000 ºC E53 in fab or E13 in subfab (note 2) KS2 opens K3 and K4 (note 2) AS2 opens K3 and K4 (note 2) Remove broken wafer Process chamber Thermal: cooling plate process gases Not needed, as the heat transfer fluid is water, as is the utility to which it transfers heat, so the minimum temperature does not comprise a touch hazard. PG6 in fab or PG3 and PG 5 in the subfab KS2 closes PG11 and PG12 AS2 or PS7 closes PG11 and PG12 process residue There s no available isolating device, so alternative methods must be used. automated purging and cleaning processes, work practices, supplemental ventilation, or PPE Electromagnetic: exposure to microwave energy E54 in fab or E14 in subfab. (note 3) KS2 opens K3 and K4. AS2 or PS7 opens K3 and K4 process gas flows PG2 and PG4 PG2 and PG4 (note 1) AS3 closes PG2 and PG4 Replace filters in process gas lines Gas panel Mechanical: exposure to process gas pressure process gas remaining in piping PG2 and PG4 PG2 and PG4 (note 1) There s no available isolating device, so alternative methods must be used. AS3 closes PG2 and PG4 automated purging and cleaning processes, work practices, supplemental ventilation, or PPE Replace filters in inert gas lines Gas panel process gas flows process gas remaining in piping Mechanical: exposure to inert gas pressure IG3 and IG5 None (note 4) IG3 and IG5 IG3 and IG5 (note 1) IG3 and IG5 (note 1) AS3 deactivates A31 AS3 deactivates A31 Replace parts handler motor controller Electrical rack in subfab Electricity E7 E7 (note 1) Finger safe electrical connector Page 10 of 14

11 Notes: Table 2: CoHE means for sample tasks 1) As the work is to be done near (most importantly, on the same floor as) the energy isolating device, there s no great advantage to performing lockout from somewhere else. 2) Removing electrical power from the heater addresses contact with the electricity and the addition of heat, but it does not cause instantaneous cooling to a touch-safe temperature. Therefore, administrative controls (labeling and procedure) are needed to allow the chuck to cool before beginning work in the process chamber. 3) Installing a disconnecting device in the waveguide would require a large amount of space and could degrade performance and disassembling a waveguide is time consuming and, in some cases, presents access challenges, so E54 is provided to enable direct lockout in the fab. 4) Risk assessment found that the risk of this exposure is acceptable. 5) Protection from the thermal hazard of the chuck during work in the transfer chamber with the door between the chambers open is needed only if there is a credible expectation of contact with the hot parts. In most systems, there is no credible risk of accidental contact by personnel; in some systems, it is not geometrically possible to reach through the door between the chambers from the transfer chamber to the wafer chuck. Current Situation Within Semiconductor Industry Semiconductors are fabricated in fab cleanrooms, because the control of even the smallest particles is key to the successful yields. As the costs of constructing and operating cleanrooms are high, many of the supporting modules (which distribute multiple hazardous energies) of the equipment are located in subfabs, the floors directly below the cleanrooms. Subfabs are usually not cleanrooms or are cleanrooms of less stringent controls, so they are less expensive to construct and operate. The hazardous energies in the semiconductor industry include: Distributed Electrical (high voltages, high currents) Stored Electrical (capacitors, batteries) Pressurized Liquids (hydraulic, pumped) Compressed Gases (liquefied, or pressurized) Electromagnetic Radiation (X Ray, RF, IR, UV, lasers) Static Magnetic Fields (permanent magnets) Gravitational Energy (e.g. suspended, hinged loads) Kinetic Energy (moving robots, linear drives, gears) Thermal / Cryogenic Energy ( hot, cold temperatures) Chemical Energy (heat of reaction, fire, explosion) Stored Mechanical Energy (springs, elastic seals) Each of these hazardous energies can lead to harm to personnel, as well as significant equipment, facility and environmental damages. The semiconductor industry, however, is very highly automated, so very few worker tasks are required during production uptime. Most human interaction with the equipment occurs during scheduled or unscheduled downtime. When any situation requiring worker intervention occurs, the equipment must be placed in a state so as to prevent unexpected startup or re-energization. When isolation and de-energization methods prohibit the completion of certain tasks, alternative Control of Hazardous Energy (CoHE) methods are allowed, to prevent unexpected startup of the equipment. In these special cases, the use of robust control circuit designs can provide a highly-reliable engineered solution to control these hazardous energies. The semiconductor industry has adopted these functional safety design approaches (e.g., control reliable) when hazardous energies are required for certain specific tasks (e.g. robot teach pendants, enable switches, etc.) or during the infrequent minor service exemption tasks during normal production (e.g., CoHE via a maintenance key, trapped keys). Page 11 of 14

12 The semiconductor industry operates globally. Only 20% of the equipment used for semiconductor fabrication is used in the U.S. The rest is used outside the U.S. and these other regions (Europe, Asia, etc.) allow for the use of properly designed safety functions (based on hazard risk assessment) to prevent the unexpected start up or re-energization during required service and maintenance tasks, especially during non-production time. For the fabs within the U.S., fab owners face a very different situation. Within the US, when the hazardous energy is not required to be energized during a service and maintenance tasks, the semiconductor industry must follow OSHA s Lock-Out requirements. In some cases, equipment manufacturers have written CoHE procedures in order to comply with the OSHA requirements. Unfortunately, these lockout protocols for service and maintenance tasks within the semiconductor industry can be very complex. Entire wafer processing equipment is taken completely down/off only infrequently. To maximize throughput, semiconductor equipment is usually modular, so that one process chamber can be taken down for maintenance or service while the other process chambers remain up and running. Performing lockout on a single process chamber, using the required energy isolating devices, commonly requires worker to prepare that process chamber for lockout, then leave the fab to go downstairs to the subfab to actuate and lock the energy isolating devices on the equipment s subsystem/support module(s). Once the lockout is verified at the cleanroom level, the worker can then perform the maintenance or service task. After the maintenance or service task is completed, the worker(s) must exit the cleanroom, de-gown again, go back downstairs to remove their personal locks within the subfab. They must then follow the cleanroom procedures for re-entry into cleanroom, and then restart the equipment. If the situation is not corrected on the first attempt, the entire lockout process has to be repeated until the situation is corrected. In the simplest case, this requires two degownings, two gownings, and four moves between building levels: Figure 3: Example of travel necessitated by use of direct lockout for the simples case. Page 12 of 14

13 Each typical degowning and each regowning includes two layers of shoe covering; two layers of head covering; at least one layer of face covering; one layer covering the torso, arms, and legs; and at least one pair of gloves. As semiconductor fabs usually install many pieces of like equipment side by side, the worker must be careful to identify and manage the hazardous energies of the correct one. The risk of having locked out the wrong equipment is managed by the verification step. When working on our industry s more complex equipment designs, it is not uncommon to need to lockout ten or more different hazardous energy sources The energy sources typically found in semiconductor equipment include: X ray, RF, MW power supplies, multiple chemical isolation valves, N2 purge gas isolation valves, heaters, cooling water distribution valves linear actuator motor(s) CDA for pneumatic actuated part(s) process chamber gate valves, laser(s), Furthermore, there are some systems in which hazardous energies must be managed stepwise. Consider, for example, the case of a piece of chemical process equipment in which the supplies of hazardous production materials (HPMs) must be isolated, but other hazardous energy sources, such as electrical power and purge fluids, must be used for removal of the residual HPMs. Such a case requires three degownings, three gownings, and six moves between building levels: Figure 4: Example of travel necessitated by use of direct lockout. While these steps are straight forward, and can be followed in sequence successfully, they are tedious and prone to human error. Semiconductor lockout processes on multiple floor levels, with many like machines side by side, and many different hazardous energy sources unfortunately lend themselves to reasonably foreseeable errors or to misuse of not performing all the required lockout steps correctly. Page 13 of 14

14 Fortunately, outside the U.S., these same equipment companies are permitted to prevent unexpected energization of the equipment using remote lockout system designs (i.e., as described in White Paper B), instead of the approach required by OSHA, to prevent the unexpected starting of the equipment. Recall that, due to the current regulations in the US, remote lockout features may not be used. In other jurisdictions, however, they can be applied for many other different maintenance tasks during downtime. The primary advantage of allowing such remote lockout methods during other downtime tasks is that workers are able to perform their remote lockout procedure from within the fab where the maintenance and service is to be performed. It is faster, less prone to human error, and much more reliable than the OSHA approach to lockout. This remote lockout approach, using control circuit isolation, has been used with much success throughout the world. The only alternative to the semiconductor industry s fab / subfab situation is to redesign the existing and all new equipment and move each of the individual lockout locations into the cleanroom level of the fabs. This is an extremely costly endeavor, particularly when only 20% of the global equipment is used in the U.S. The remote lockout process (as described in White Paper B) has been effective globally and is used to prevent the unexpected startup or re-energization of equipment in the semiconductor industry. It is hoped that this method can be used with an expanded scope to other downtime service tasks following the sound engineering design requirements as outlined within this standard. Page 14 of 14