San Francisco Marriott Marquis Hotel 55 Fourth Street City, State/Country: San Francisco, CA / USA San Francisco, CA / USA Leader(s):

Similar documents
SEMI Headquarters 3081 Zanker Road City, State/Country: San Jose, CA, USA San Jose, CA, USA Leader(s):

PL estimation acc. to EN ISO

Session: 14 SIL or PL? What is the difference?

Introduction to Machine Safety Standards

CT433 - Machine Safety

New Thinking in Control Reliability

Understanding safety life cycles

Background Statement for SEMI Draft Document 5623 Line Item Revisions to SEMI S E, SAFETY GUIDELINE FOR EQUIPMENT SAFETY LABELS

The Best Use of Lockout/Tagout and Control Reliable Circuits

Implementing Emergency Stop Systems - Safety Considerations & Regulations A PRACTICAL GUIDE V1.0.0

RISK ASSESSMENT. White Paper.

What safety level can be reached when combining a contactor with a circuitbreaker for fail-safe switching?

Safety in pneumatic automation

Machine Safety Guide 1

Applications & Tools. Evaluation of the selection of a safetyrelated mode using non-safety-related components

Safe Machinery Handbook

Safety Manual VEGAVIB series 60

model for functional safety of

Safe Machinery Handbook

Safety Legislation and Standards

SIL Safety Manual. ULTRAMAT 6 Gas Analyzer for the Determination of IR-Absorbing Gases. Supplement to instruction manual ULTRAMAT 6 and OXYMAT 6

Implementing IEC Standards for Safety Instrumented Systems

Managing for Liability Avoidance. (c) Lewis Bass

ISO INTERNATIONAL STANDARD. Hydraulic fluid power Filter elements Determination of resistance to flow fatigue using high viscosity fluid

Linking Risk and Reliability Mapping the output of risk assessment tools to functional safety requirements for safety related control systems.

DETERMINATION OF SAFETY REQUIREMENTS FOR SAFETY- RELATED PROTECTION AND CONTROL SYSTEMS - IEC 61508

A study on the relation between safety analysis process and system engineering process of train control system

The following gives a brief overview of the characteristics of the most commonly used devices.

TEST REPORT Safety Laboratory-MD Team Report No.: RA/2013/90003

Safety Manual VEGAVIB series 60

Safety Manual OPTISWITCH series relay (DPDT)

Functional safety. Functional safety of Programmable systems, devices & components: Requirements from global & national standards

Safety manual for Fisher GX Control Valve and Actuator

Failure Modes, Effects and Diagnostic Analysis

This manual provides necessary requirements for meeting the IEC or IEC functional safety standards.

Section 1: Multiple Choice Explained EXAMPLE

Safety Manual. Process pressure transmitter IPT-1* 4 20 ma/hart. Process pressure transmitter IPT-1*

Safety-critical systems: Basic definitions

Section 1: Multiple Choice

RESILIENT SEATED BUTTERFLY VALVES FUNCTIONAL SAFETY MANUAL

SIL explained. Understanding the use of valve actuators in SIL rated safety instrumented systems ACTUATION

ICS Supersedes EN ISO :2006. English Version

Using what we have. Sherman Eagles SoftwareCPR.

Transmitter mod. TR-A/V. SIL Safety Report

Risk Management Series Article 8: Risk Control

Solenoid Valves used in Safety Instrumented Systems

T71 - ANSI RIA R15.06: Robot and Robot System Safety

YT-3300 / 3301 / 3302 / 3303 / 3350 / 3400 /

Accelerometer mod. TA18-S. SIL Safety Report

Background Statement for SEMI Draft Document #4401 Line Item Revisions to SEMI S1, SAFETY GUIDELINE FOR EQUIPMENT SAFETY LABELS

Pneumatic QEV. SIL Safety Manual SIL SM Compiled By : G. Elliott, Date: 8/19/2015. Innovative and Reliable Valve & Pump Solutions

Ultima. X Series Gas Monitor

ISO INTERNATIONAL STANDARD. Natural gas Measurement of properties Volumetric properties: density, pressure, temperature and compression factor

QUANTIFYING THE TOLERABILITY OF POTENTIAL IGNITION SOURCES FROM UNCERTIFIED MECHANICAL EQUIPMENT INSTALLED IN HAZARDOUS AREAS

Failure Modes, Effects and Diagnostic Analysis

EL-O-Matic E and P Series Pneumatic Actuator SIL Safety Manual

Functional Safety SIL Safety Instrumented Systems in the Process Industry

DeZURIK. KGC Cast Knife Gate Valve. Safety Manual

ISO INTERNATIONAL STANDARD. Gas cylinders Safe handling. Bouteilles à gaz Sécurité de manutention. Second edition

ISO INTERNATIONAL STANDARD. Plain bearings Appearance and characterization of damage to metallic hydrodynamic bearings Part 1: General

Neles trunnion mounted ball valve Series D Rev. 2. Safety Manual

ISO INTERNATIONAL STANDARD. Ergonomics Manual handling Part 1: Lifting and carrying

Application Note. Safety Sub-functions SSC Category 1, up to PL c PUS Category 1, up to PL c. Application Note SSC, PUS, Category 1, up to PL c STOP

YT-300 / 305 / 310 / 315 / 320 / 325 Series

ISO INTERNATIONAL STANDARD. Earth-mover tyres and rims Part 3: Rims. Pneumatiques et jantes pour engins de terrassement Partie 3: Jantes

Failure Modes, Effects and Diagnostic Analysis. Rosemount Inc. Chanhassen, MN USA

Transducer mod. T-NC/8-API. SIL Safety Report

Safety Circuit Design. Heinz Knackstedt Safety Engineer C&E sales, inc.

Application Note. Safety Sub-function PUS Category 1, up to PL c. Application Note PUS, Category 1, up to PL c M20 S22 R20 M1 Q20

Reliability of Safety-Critical Systems Chapter 3. Failures and Failure Analysis

DSL, DSH: Specially designed pressure limiter

Understanding the How, Why, and What of a Safety Integrity Level (SIL)

High Integrity Pressure Protection Systems HIPPS

Every things under control High-Integrity Pressure Protection System (HIPPS)

Bespoke Hydraulic Manifold Assembly

THE IMPROVEMENT OF SIL CALCULATION METHODOLOGY. Jinhyung Park 1 II. THE SIL CALCULATION METHODOLOGY ON IEC61508 AND SOME ARGUMENT

Eutectic Plug Valve. SIL Safety Manual. SIL SM.015 Rev 0. Compiled By : G. Elliott, Date: 19/10/2016. Innovative and Reliable Valve & Pump Solutions

Hydraulic (Subsea) Shuttle Valves

Neles ValvGuard VG9000H Rev 2.0. Safety Manual

Safety Critical Systems

ISO INTERNATIONAL STANDARD

ISO INTERNATIONAL STANDARD. Mechanical vibration Balancing Guidance on the use and application of balancing standards

Solenoid Valves For Gas Service FP02G & FP05G

Tullis Russell Machinery Safety Conference. David Robinson - Process Control Manager

MTS SafeGuard Technology. Solutions to protect test operators, equipment and specimen. be certain.

DeZURIK Double Block & Bleed (DBB) Knife Gate Valve Safety Manual

DeZURIK. KSV Knife Gate Valve. Safety Manual

ISO INTERNATIONAL STANDARD

ISO INTERNATIONAL STANDARD. Earth-mover tyres and rims Part 3: Rims. Pneumatiques et jantes pour engins de terrassement Partie 3: Jantes

ISO INTERNATIONAL STANDARD

DATA ITEM DESCRIPTION Title: Failure Modes, Effects, and Criticality Analysis Report

ISO INTERNATIONAL STANDARD. Snowboard plate-bindings without a release mechanism Requirements and test methods

C. Mokkapati 1 A PRACTICAL RISK AND SAFETY ASSESSMENT METHODOLOGY FOR SAFETY- CRITICAL SYSTEMS

ISO 9244 INTERNATIONAL STANDARD. Earth-moving machinery Machine safety labels General principles

TRI LOK SAFETY MANUAL TRI LOK TRIPLE OFFSET BUTTERFLY VALVE. The High Performance Company

SPR - Pneumatic Spool Valve

FP15 Interface Valve. SIL Safety Manual. SIL SM.018 Rev 1. Compiled By : G. Elliott, Date: 30/10/2017. Innovative and Reliable Valve & Pump Solutions

Valve Communication Solutions. Safety instrumented systems

This document is a preview generated by EVS

ISO INTERNATIONAL STANDARD

Transcription:

Background Statement for SEMI Draft Document 5000A DELAYED REVISIONS TO SEMI S2-0310e, ENVIRONMENTAL, HEALTH, AND SAFETY GUIDELINE FOR SEMICONDUCTOR MANUFACTURING EQUIPMENT Addition of Related Information to S2: Selection of Interlock Reliability Notice: This background statement is not part of the balloted item. It is provided solely to assist the recipient in reaching an informed decision based on the rationale of the activity that preceded the creation of this Document. Notice: Recipients of this Document are invited to submit, with their comments, notification of any relevant patented technology or copyrighted items of which they are aware and to provide supporting documentation. In this context, patented technology is defined as technology for which a patent has issued or has been applied for. In the latter case, only publicly available information on the contents of the patent application is to be provided. Background This Related information is been added to create awareness on the selection of the reliability of interlocks. Original also examples would be added, but because there is now a joint working commission of the standards mentioned in this RI working on examples they will be added later. Details how to design and calculate reliability of interlocks is not covered and can be found in the referenced standards. This will beaded to SEMI S2 as a delayed implementation July 2015. Review and Adjudication Information Task Force Review Committee Adjudication Group: S2 Interlock Reliability TF NA EHS Committee Date: Monday, July 9, 2012 Thursday, July 12, 2012 Time & Timezone: 3:30 PM to 5:00 PM, Pacific Time 9:00 AM to 6:00 PM, Pacific Time Location (tentative): San Francisco Marriott Marquis Hotel 55 Fourth Street San Francisco Marriott Marquis Hotel 55 Fourth Street City, State/Country: San Francisco, CA 94103 / USA San Francisco, CA 94103 / USA Leader(s): Bert Planting (ASML) Tom Pilz (Pilz Automation) Chris Evanston (Salus) Sean Larsen (Lam Research AG) Standards Staff: Paul Trio (SEMI NA) 408.943.7041 ptrio@semi.org Eric Sklar (Safety Guru, LLC) Paul Trio (SEMI NA) 408.943.7041 ptrio@semi.org This meeting s details are subject to change, and additional review sessions may be scheduled if necessary. Contact the task force leaders or Standards staff for confirmation. Telephone and web information will be distributed to interested parties as the meeting date approaches. If you will not be able to attend these meetings in person but would like to participate by telephone/web, please contact Standards staff.

Safety Checklist for SEMI Draft Document 5000A Title: DELAYED REVISION TO SEMI S2-0310e, ENVIRONMENTAL, HEALTH, AND SAFETY GUIDELINE FOR SEMICONDUCTOR MANUFACTURING EQUIPMENT Addition of Related Information to S2: Selection of Interlock Reliability Developing/Revising Body Name/Type: S2 Interlock Reliability Task Force Technical Committee: EHS Region: Europe / North America Leadership Position Last First Affiliation Leader Planting Bert ASML Leader Pilz Tom Pilz Automation Documents, Conflicts, and Consideration Safety related codes, standards, and practices used in developing the safety guideline, and the manner in which each item was considered by the technical committee # and Title Manner of Consideration ISO 13849-1: Safety of machinery - Safety-related parts of control systems - Part 1: General principles for design (ISO 13849-1:2006, IDT). ISO 13849-2: Safety of machinery - Safety-related parts of control systems - Part 2: validation (ISO 13849-2). IEC 61062: Safety of machinery - Functional safety of safety-related electrical, electronic and programmable electronic control systems. EN 954-1: Safety of machinery - Safety-related parts of control systems - Part 1: General principles for design NOTE: this has been succeeded by the ISO 13849-1. European ATEX directive: 94/9/EC. IEC_TR_62061-1 Guidance on the application of ISO 13849-1 and IEC 62061 in the design of safety related control systems. SEMI S10: Safety guideline for Risk assessment and risk evaluation process. Reviewed, considered, and attempted to summarize as applied to semiconductor manufacturing equipment. Known inconsistencies between the safety guideline and any other safety related codes, standards, and practices cited in the safety guideline # and Title Inconsistency with This Safety Guideline None known None known Other conflicts with known codes, standards, and practices or with commonly accepted safety and health principles to the extent practical # and Title Nature of Conflict with This Safety Guideline None

Team member Name Company E-mail Bert Planting (TF-leader) ASML Bert.Planting@ASML.com Thomas Pilz Pilz GmbH & Co. KG t.pilz@pilz.de Brian McMorris SICK, Inc. Brian.McMorris@sick.com Mark Fessler Tokyo Electron mark.fessler@us.tel.com Contributors Name Company E-mail Eric Sklar Safety Guru sklar@safetyguru.com Cliff Greenberg Nikon cgreen@nikon.com Ken Mills Estec Solutions kmills@estecsolutions.com Joe Barsky Lewis Bass Int. joe.barsky@lewisbass.com Sean Larsen Cymer/LAM AG splarsen@gmail.com Mark Frankfurth Cymer Mark_Frankfurth@cymer.com Ken Kapur KLA-Tencor ken.kapur@kla-tencor.com Matthew Grinn TEL Matthew.Gwinn@us.tel.com Shigehito Ibuka TEL shigehito.ibuka@tel.com Paul Kelly Estec Solutions pkelly@estecsolutions.com Carl Wong AKT carl_wong@amat.com Debbie Sawyer Semitool/glaciere export services dsawyer@glacierexportservices.com Lauren Crane KLA Lauren.Crane@kla-tencor.com Sunny Rai Intertek sunny.rai@intertek.com Alan Crockett KLA-Tencor alan.crockett@kla-tencor.com Ron Birrel TUV-Sud rbirrell@tuvam.com Horrey Hum ESTEC solutions hhum@estecsolutions.com Steve Baldwin Lewis Bass Steve.baldwin@lewisbass.com Sandeep Bendale Lewis Bass sandeep@lewisbass.com Raymond McDaid Lam Research Raymond.mcdaid@lamresearch.com Alan Krov TEL Alan.krov@us.tel.com David Sexton TUV dsexton@us.tuv.com Mark Bogner TUV-Sud Mark.bogner@tuv-sud.jp Kyle Lebouitz Xactix kylel@xactix.com Paul Breder ESTEC solutions pbreder@estecsolutions.com Byron Yakimov Cymer byakimow@cymer.com Ron Macklin Macklin assoc ron@rmacklinandassociates.com Joe Basky Intertek Joseph.barsky@intertek.com Samir Sleiman SSleiman22@gmail.com Chris Evanston Salus chris.evanston@salusengineering.com Lindy Austin Salus Lindy.Austin@salusengineering.com Alan Crocket KLA Alan.crocket@KLA-tencor.com Ken Kuwatani TUV Sud KKuwatani@TUVam.com Rich Petronio VEECO Rpetronio@Veeco.com Ton Vang LAM Ton.Vang@lamresearch.com

Nigusu Ergete Intertek/GS3 Nigusu.ergete@intertek.com Raymond McDaid LAM Research Raymond.mcdaid@lamresearch.com Brian Cleas LAM research Brian.cleas@lamresearch.com Alan Cose Intertek GS3 Allan.cose@intertek.com Peter Hsu Aixtron p.hsu@aixtron.com Paul Green Ultratech pgreen@ultratech.coom Edward karl Applied Materials edward_karl@amat.com

SEMI Draft Document 5000A DELAYED REVISION TO SEMI S2-0310e, ENVIRONMENTAL, HEALTH, AND SAFETY GUIDELINE FOR SEMICONDUCTOR MANUFACTURING EQUIPMENT Addition of Related Information to S2: Selection of Interlock Reliability DELAYED REVISIONS Z (Effective July 2015) NOTICE: This Delayed Revisions Section contains material that has been balloted and approved by the global [insert committee name] Technical Committee, but is not immediately effective. The provisions of this material are not an authoritative part of the Document until their effective date. The main body of [insert designation] remains the authoritative version. Some or all of the provisions of revisions not yet in effect may optionally be applied prior to the effective date, providing they do not conflict with portions of the authoritative version other than those that are to be revised or replaced as part of the deferred revision, and are labeled accordingly. NOTICE: Unless otherwise noted, all material to be added shall be underlined, and all material to be deleted shall be struck through. DZ-1 Addition of Related Information XX to SEMI S2: Selection of Interlock Reliability (OPTIONAL before effective date) DZ-1.1 Add new Related Information section: Selection of Interlock Reliability RELATED INFORMATION XX SELECTION OF INTERLOCK RELIABILITY NOTICE: This Related Information is not an official part of SEMI [designation number] and was derived from the work of the global [committee name] Technical Committee. This Related Information was approved for publication by full letter ballot procedures on [A&R approval date]. R1-1 Purpose R1-1.1 In the section of interlocks of this standard guidelines are given for safety interlock systems. Because new technologies are used and safety systems can be complex guidance is given to standards that might be useful. This RI explains how several different standards on safety interlocks or safety related part of control systems reliability are related, how to select a reliability level of the safety interlock or safety related part of control systems and how they determine the reliability performance. This RI also provides a comparison among the definitions of reliability levels in the several standards. R1-2 Limitations R1-2.1 This RI does not provide details of calculations that determine the reliability of a safety interlocks or safety related part of control systems. R1-3 Referenced Standards and Documents R1-3.1 SEMI Standards and Safety Guidelines SEMI S10 Safety guideline for Risk assessment and risk evaluation process Page 1 Doc. 5000A SEMI

R1-3.2 IEC Standards 1 IEC 61062 Safety of machinery - Functional safety of safety-related electrical, electronic and programmable electronic control systems IEC 61496 Safety of machinery - Electro-sensitive protective equipment IEC 61508 Functional Safety of Electrical/Electronic/Programmable Electronic Safety-related Systems R1-3.3 ISO Standards 2 ISO 13849-1 Safety of machinery - Safety-related parts of control systems - Part 1: General principles for design ISO 13849-2 Safety of machinery - Safety-related parts of control systems - Part 2: Validation (ISO 13849-2 ISO TR 23849 Guidance on the application of ISO 13849-1 and IEC 62061 in the design of safety related control systems. R1-3.4 Other Standards and Documents European ATEX directive: 94/9/EC EN 954-1 Safety of machinery - Safety-related parts of control systems - Part 1: General principles for design NOTE 1: EN 954-1 this has been succeeded by the ISO 13849-1. R1-4 Introduction R1-4.1 Safety interlocks or safety related part of control systems are used to reduce risk of harm to people. Several standards require different levels of reliability of safety interlocks or safety related part of control systems depending on the risk. Risk is evaluated on several factors like: frequency people are expected to be harmed the severity of the harm whether there is a possibility to notice the risk and avoid the harm. R1-4.1.1 There are several standards that describe the reliability of safety interlocks or safety related part of control systems. Other standards (e.g. robot standards) refer to these basic reliability standards for reliabilities. R1-4.2 This RI is limited to the selection of the reliability. Information about how reliability can be determined or calculated can be found in the referenced standards. R1-4.3 Depending on the standard the criteria for the safety interlocks or safety related part of control systems selection is based on harm to people sometimes combined with damage to equipment/installations. R1-5 Relation SEMI S10 and Interlock reliability selection R1-5.1 SEMI S10 is used for risk identification, ranking and evaluation. When there is a risk identified that needs mitigation of the risk (e.g. S10 risk-ranking is medium or higher) several options are possible (e.g. change design, add protection, use interlocks, ). If the mitigation is done by using safety interlocks or safety related part of control systems, these have to have a reliability level that is suitable for the mitigation. R1-5.2 After the mitigation has been implemented a new risk assessment to be carried out. 1 International Electrotechnical Commission, 3 rue de Varembé, Case Postale 131, CH-1211 Geneva 20, Switzerland; Telephone: 41.22.919.02.11, Fax: 41.22.919.03.00, http://www.iec.ch 2 International Organization for Standardization, ISO Central Secretariat, 1 rue de Varembé, Case postale 56, CH-1211 Geneva 20, Switzerland; Telephone: 41.22.749.01.11, Fax: 41.22.733.34.30, http://www.iso.ch Page 2 Doc. 5000A SEMI

NOTE: Reliability to be based on the risk. The standards ISO13849-1 and IE61062 are 2 possible ways how to determine the reliability level. R1-6 Selection of the interlock system standard Figure R1-1 Relation SEMI S10 and interlock selection R1-6.1 Because there are many types of interlocks each standard has its own application and use. Table R1-1 Application of safety system related standards Standard Typical use Components covered remarks ISO 13849-1: Safety of machinery - Safety-related parts of control systems Calculation of the reliability of individual components and a complete Interlock control systems It applies to any type of technology and energy used. (electrical, hydraulic, pneumatic, mechanical, and software.) ISO 13849-2 provides info how to calculate reliability of all types of components IEC 61062: Safety of machinery - Functional safety of safety-related electrical, electronic and programmable electronic control systems Calculation of the reliability of a complete Interlock control systems Electromechanical, control system Used for complete systems qualification Page 3 Doc. 5000A SEMI

Standard Typical use Components covered remarks EN 954-1: Safety of machinery - Safety-related parts of control systems - Part 1: General principles for design 60508 Functional Safety of Electrical/Electronic/Programm able Electronic Safety-related Systems European ATEX directive: 94/9/EC Reliability based on component reliability and architecture of the safety system Verify a control systy that uses software Defines reliability levels for components that need to be used in explosive atmospheres All electromechanical, electrical, valves, control systems PLC controlled system Special requirements for components that need to be used in explosive atmospheres R1-7 Safety-related parts of control systems selection based on ISO 13849-1 this has been succeeded by the ISO 13849-1 Used for requirements of a software control system. Mostly a safety PLC is approved based on this standard Components used in explosive atmospheres need to be CE marked R1-7.1 This standard uses a decision tree to identify a performance level for the safety-related parts of control systems design. Before the risk estimation can be done it is important to clearly understand the hazard scenario which exists if the safety function was not available (fails). Remember that risk reduction by other technical measures independent of the control system (e.g. mechanical guards, administrative controls, LOTO, PPE, etc) can be taken into account in determining PLr (required Performance Level). There are 3 parameters that the safety review team needs to know about, related to the machinery hazards during operation, maintenance and service, in order to determine the required Performance Level. Severity of the injury (S) S1: Slight, normally reversible injury S2: serious, normally irreversible injury or death Frequency or exposure to the hazard (F) F1: Seldom to less-often and/or exposure time is short F2: frequent-to-continuous and/or exposure time is long Possibility of avoidance the harm or limiting the harm (P) P1: Possible under specific conditions P2: Scarcely possible NOTE 2: Although the standard is using and/or in its definition for frequencies, the SEMI working group believes these should be: F1: Seldom to less-often and exposure time is short F2: frequent-to-continuous or exposure time is long Page 4 Doc. 5000A SEMI

Figure R1-2 ISO 13849-1 Decision Tree R1-7.2 The reliability in the ISO 13849-1 is expressed in performance levels (PL) a, b, c, d or e with increasing reliability. These five discrete levels (a, b, c, d and e) are then used to specify the minimum design requirements for the safety related parts of a control system (e.g. a safety interlock) to ensure they perform their function under foreseeable use / mis-use conditions. This must be done for each safety function, but remember its not just electrical interlocks, it is needed for pneumatic, hydraulic and mechanical interlocks as well : R1-7.3 The initial estimation (per Figure R1-2) of the performance level for the interlock s design is only the beginning of the total design process. The design engineer(s) must first assess how robust he/she is going to build the safety control system for mitigating the hazard as previously defined in the safety PLr. This important decision is based upon 3 things: How will the structural layout of the control system be chosen? Will the safety control system have any monitoring / fault detection? How will the component reliability requirements be chosen / met? R1-7.4 The standard introduces 4 parameters that the designers will need to know about their safety circuit / control system in order to determine the achieved Performance Level (PL): R1-7.4.1 Control System Category This is the classification of the safety architecture based on the structural arrangement of parts, fault detection and the component reliability of the parts selected. These control categories were originally defined in EN954-1. (e.g. CAT B, CAT 1, CAT2, CAT 3 and CAT4). R1-7.4.2 MTTF d Mean Time to a Dangerous Failure (in years). The MTTF d is the average time in which a failure that would lead to a dangerous situation occurs in the interlock circuit. The MTTFd is considered to be Low (between 3 to 10 years), Medium (between 10 and 30 years) or High (more than 30 Years). R1-7.4.3 DC avg Average Diagnostic Coverage (%). The DC avg is the % proportion of dangerous failures that can be detected by the safety design (SRP/CS), compared to all of conceivable dangerous failures that exist - both detectable and undetectable failures. It is determined by how frequently and accurately the system performs some self-diagnosis, and what it actions it takes if it senses something wrong. The DC is considered to be: not available (< 60%), Low ( 60% <90%), Medium ( 90% - <99%) or High ( 99% detected). R1-7.4.4 CCF Common Cause Failure. CCF can be simply thought of as an indicator of whether or not sound engineering practices were followed to ensure parallel channels of the safety interlock is not damaged by common Page 5 Doc. 5000A SEMI

causes. ISO 13849-1 uses a standard PASS/FAIL checklist is used to help designer to justify if they have included basic considerations to prevent common failures. Having technical measures for avoiding CCF is for designer justifying the SRP/CS to CAT 2, 3 or 4 architectures, but CCF is simply not relevant for single channels CAT B or CAT 1. R1-7.5 ISO 13849-1 then uses complex mathematical techniques with intelligent grouping to estimate the safety system achieved performance level based on these 4 basic interlock design factors. Figure R1-3 Overview of ISO 13849-1 Design Validation Process R1-7.6 The standard provides both a tabular (refer to Table R1-1 below) and graphical way to estimate the achieved PL of a single channel. Design validation occurs when the achieved PL is greater than or equal to required performance level (PL r.). If this is not the case, then a design modification or iteration is necessary. Table R1-2 Simplified relation between PL and Category levels Average Diagnostic coverage (DC avg ) Mean Time To dangerous Failure (MTTF d ) Low Medium High Simplified relation between the achieved PL and the other 4 design parameters Category B 2 2 2 3 3 4 None None Low Medium Low Medium High a b Not covered Not covered Not covered a b b d b c c d Not covered Not covered c c d d d e Page 6 Doc. 5000A SEMI

NOTE 3: More detailed information about comparison between performance levels and the design parameters of the safety interlock can be found in ISO 13849-1. R1-8 Functional safety of safety related electrical, electronic and programmable electronic control systems selection based on IEC 62061 R1-8.1 This standard uses severity of harm (Se); and a class (Cl) for probability of occurrence of the harm. R1-8.2 Severity (Se) is divided in 4 levels, as is shown in Table R1-3 Table R1-3 Severity levels (Se) Severity level 1 Reversible: requiring first aid only Consequence 2 Reversible injury, including severe lacerations, stabbing, and severe bruises that requires attention from a medical practitioner. Reversible: requiring attention from a medical practitioner 3 Irreversible injury such that it can be possible to continue work after healing. It can also include a severe major but reversible injury such as broken limbs 4 Irreversible: death, losing an eye or limb R1-8.2.2 Class of probability of occurrence of harm (Cl) is a function of: Frequency and duration of the exposure of persons to the hazard (Fr) 7.2.2, Probability of occurrence of a hazardous event arising from human and machine behavior (Pr ) 7.2.3; Probability of avoiding the risk or limiting the harm (Av) 7.2.4. R1-8.2.3 Frequency and duration of the exposure of persons to the hazard R1-8.2.3.1 Frequency and duration of the exposure of persons to the hazard is based on how often persons are exposed and the time people are exposed. Table R1-4 provides the values of Fr for various frequencies and durations R1-8.2.3.2 The frequency of exposures is divided into 5 levels of time between exposures R1-8.2.3.3 The duration of people are exposed to the hazard is divided into 2 levels: < 10 minutes per occurrence and 10 minutes per occurrence. Table R1-4 Frequency and duration of Exposure (Fr) Frequency (time between exposures) Duration < 10 Min. Duration 10 min 1 hour 5 5 > 1hour to 1 day 4 5 > 1 day to 2 weeks 3 4 > 2 weeks to 1 year 2 3 > 1 year 1 2 R1-8.2.4 Probability of occurrence of a hazardous event arising from human and machine behavior (Pr) This factor is an estimation on the behavior of the machine and foreseeable characteristics of human behavior. R1-8.2.4.1 The machine behavior will vary from very predictable to not predictable but unexpected events cannot be discounted. Predictability of the behavior of component parts of the machine relevant to the hazard in different modes of use (e.g. normal operation, maintenance, fault finding). R1-8.2.4.2 Characteristics of human behavior that to be taken in account include stress, lack of awareness. These are influenced by factors such as skills, training, experience and complexity of the machine. NOTE 4: Skills and training to be stated in the documentation for use. Page 7 Doc. 5000A SEMI

Table R1-5 Probability classification Probability of occurrence Probability of occurrence factor (Pr) Very High 5 Likely 4 Possible 3 Rarely 2 Negligible 1 R1-8.2.5 Probability of avoiding or limiting the harm (Av) This factor can be estimated taken into account aspects of the machine like sudden, fast or slow appearance of the hazardous event, clearances to withdraw from the hazard and nature of the system (e.g. cutting machine will have a sharp edge, heating system will have hot surfaces, ) and the possibility of recognition of the hazard (electrical hazard can only be recognized by using a meter, noise when a motor starts). Table R1-6 Probability of avoiding or limiting harm Probability of avoiding or limiting harm Probability of avoiding or limiting harm factor (Av) Impossible 5 Rarely 3 Probable 1 R1-8.2.6 Each probability functions get a rating and the class of probability of occurrence of harm (Cl) is the sum of frequency and duration (Fr), probability of occurrence (Pr) and possibility of avoidance (Av). Cl = Fr + Pr + Av (1) R1-8.2.7 The SIL requirement is given in table R1-7. Table R1-7 SIL requirement Severity Class 3-4 5 7 8-10 11 13 14-15 4 SIL 2 SIL 2 SIL 2 SIL 3 SIL 3 3 #1 SIL 1 SIL 2 SIL 3 2 #1 SIL 1 SIL 2 1 #1 SIL 1 #1 For these levels other measures may be appropriate (e.g. PL a) R1-8.3 The calculation of the SIL levels will be based on the architecture of the design and the reliability data of the chosen components. Details can be found in IEC 62061. R1-9 Interlock selection based on EN 954-1 R1-9.1 This section is for reference only because EN 954-1 has been replaced by ISO 13849-1. R1-9.2 The hardware requirements of EN 954-1 were based on hardware and fault tolerance. R1-9.3 Interlock reliability is determined in a decision diagram using severity of possible harm, frequency of exposure and the possibility of avoidance. R1-9.4 Definition of severity, frequency and possibility of avoidance are identical to the ISO 13849-1 (see R1-7) Page 8 Doc. 5000A SEMI

R1-10 Other standards that might be useful Figure R1-3 Interlock category selection based on EN 954-1 R1-10.1 The European legislation for Explosive Atmospheres (ATEX) also defines reliability of the components which can be used in areas with an explosion risk. This risk assessment is based on substances used and time a hazardous atmosphere is present. Details on the requirements for can be found in 4.2.4. R1-10.2 IEC 61508 series provides information and requirement if PLC and logic is used. Preferably a software application used in safety to be approved by a notified body against this standard. R1-10.3 ISO TR 23849 provides information on safety components using Electro-sensitive protective equipment (e.g. light curtains) and their relation with ISO 13849-1 and IEC 10612.. R1-11 Comparison between the different reliability levels R1-11.1 The IEC_TR_62061-1 provides more information comparing the ISO 13849-1 and IEC 62061 and provides an introduction to calculation of reliability levels. PFH d is an estimated data point (parameter) of a subsystem that does take into account the contribution of factors such as diagnostics, proof of test interval, resistance to common cause failure and control system architecture (structure). Besides the Average Probability of a PFH d ; there are some additional estimations are still necessary to determine the achieved performance level. It is not all about probability mathematics. Table R1-8 Relationship between SIL s and Performance Levels PerformanceLevel (PL) Average probability of a dangerous failure per hour (1/h); PFH d Safety Integrity Level (SIL) a 10-5 to < 10-4 Not defined b 3*10-6 to < 10-5 1 c 10-6 to < 3*10-6 1 d 10-7 to < 10-6 2 e 10-6 to < 10-7 3 Page 9 Doc. 5000A SEMI

NOTICE: (SEMI) makes no warranties or representations as to the suitability of the Standards and Safety Guidelines set forth herein for any particular application. The determination of the suitability of the Standard or Safety Guideline is solely the responsibility of the user. Users are cautioned to refer to manufacturer s instructions, product labels, product data sheets, and other relevant literature, respecting any materials or equipment mentioned herein. Standards and Safety Guidelines are subject to change without notice. By publication of this Standard or Safety Guideline, SEMI takes no position respecting the validity of any patent rights or copyrights asserted in connection with any items mentioned in this Standard or Safety Guideline. Users of this Standard or Safety Guideline are expressly advised that determination of any such patent rights or copyrights, and the risk of infringement of such rights are entirely their own responsibility. Page 10 Doc. 5000A SEMI