AnindependentorganizationtestingforsafetyandperformanceAllservicesundertakensubjecttothefollowinggeneralpolicy:Reportsaresubmittedforexclusiveuseoftheclientstowhomtheyareaddressed.Theirsignificanceissubjecttotheadequacyandrepresentativecharacterofthesamplesandtothecomprehensivenessofthetests,examinationsorsurveysmade.NoquotationsfromreportsoruseofGS3憇nameispermittedexceptasexpresslyauthorizedbyGS3inwriting.世界半導(dǎo)體生產(chǎn)機(jī)臺(tái)安全設(shè)計(jì)驗(yàn)收標(biāo)準(zhǔn) Doc.No.980029F/June19,1998 FILENAME世界半導(dǎo)體生產(chǎn)機(jī)臺(tái)安全設(shè)計(jì)驗(yàn)收標(biāo)準(zhǔn)(doc111)英文.doc/Page世界半導(dǎo)體生產(chǎn)機(jī)臺(tái)安全設(shè)計(jì)驗(yàn)收標(biāo)準(zhǔn)(doc111)英文.doc/PagePAGE105Copyright1997byGS3,LLC.Allrightsreserved. PRIVATEATTACHMENTSEVEN-揥HAT-IF?”HAZARDANALYSISAppliedMaterialsChemicalMechanicalPolishingSystemINTRODUCTIONOnSeptember26,1996,aWhatIf?”HazardAnalysiswasconductedontheconcernsraisedbyintegratingtheMirraCMP,FABSandOnTrakSynergyIntegratoformtheAppliedMaterialsintegratedMirraTraksystemtodeterminethepotentialfordeviationsfromsystemdesignintentwhichcouldposeincreasedhazardrisk.ThismethodofhazardanalysisisdiscussedbytheAmericanInstituteofChemicalEngineers(AIChE)intheir揋uidelinesforHazardEvaluationProcedures”.Inthisanalysis,thedesignoroperatingintentofthesystemisdiscussed,andquestions(generallybeginningwiththephrase揥hatIf?”)aboutpossibledeviationsfromdesignintentareasked.Thepotentialconsequencesofeachpertinentdeviationwasdiscussedandevaluated.Ifanysingledeviationwasdeterminedtopotentiallyresultinreleaseofahazardousmaterial,majordamagetoequipmentorotherunsafecondition,thenthatdeviationwasdeemedtobeasinglepointfailureandnotcompliantwiththeS2-93Aguidelines.Scopeofthe揥hatIf?”SessionBasedonthediscussionsamongstJimAtkison;AppliedMaterialsDesignEngineer,Mr.VictorBelitsky-AppliedMaterialsCMPSeniorMechanicalEngineer,Ms.LisaPowell;AppliedMaterialsProductSafety,Mr.PeterTrein;AppliedMaterialsDesignEngineer,Mr.LynnRyle;On-TrakManagerofDevelopmentEngineering;Mr.SteveJumper,ITSProjectEngineer,andMr.JohnHatfield,EORMPrincipalConsultant.Theareasoffocusforthe"WhatIf?"analysiswere:(1)Pinchpoints;(2)robothazards;(3)Interlocks;(4)Electricalshock;and(5)chemicalsafetyhazards.ThetablewasupdatedduringtheinspectionofthesystembetweenFebruary2,1998andFebruary4,1998byMr.AndrewKileyandMr.MichaelVargaofGS3inconsultationwithMs.LisaPowellofAppliedMaterials.Thedocumentedresultsareintendedtorepresenttheconsensusofthe揥hatIf?”teamidentifiedabove.GS3didnotinvestigatetheveracityorthoroughnessofallstatementsmadebyAppliedMaterialsorOn-Trakrepresentativesduringthe揥hatIf?”session,andacceptsnoliabilityforissueswhichwerenotidentifiedduringthesessionandwhicharelaterfoundtoposehazardousconsequences.Referencethefollowingtableforasummaryoftheitemsthatwereaddressedaswellastheoutstandingitems.WhatIfAnalysis:AppliedMaterials-IntegratedMirraTrakSeptember26,1996.UpdatedFebruary4,1998 PRIVATEWHATIF?CONSEQUENCE(S)PROTECTION(S)COMMENTS/ACTION(S)OpenOn-TraklowerdoorsErgonomicissueifnotenoughspacebetweenOn-TrakandCMPwhendoorsopenedLowerdoorsarehingedandcanberemovedfromOn-TrakframetoprovidespaceNoneOpenOn-TrakcoversovercleaningsectionbyCMProbotloadingendPossibleinjurypotentialfromCMProbotend-effectorenteringOn-Trakatloadstationandhittingemployee抯handifworkinginsideofareaSpinnercoverdoorisinterlockedtopreventexposuretomovingpartsinOn-Trak.CoverissoftwareinterlockedtoCMProbot.Hardwaremechanicalkey-lockandhazardwarninglabeltopreventaccesstohazard.NoneLoseventilationoneitherOn-TrakorCMPLossofprotectionfromairbornechemicalsfromOn-TrakorCMP-noeffectonotherpartsofsystemNANoneOpenuppertowerpanelsonOn-TrakoverspinstationCouldreachintoareawhereFABSrobotend-effectorenters-possibleinjurypotentialSpinStationcoverisprovidedwithlockingpistontoholditshutduringnormaloperation.Thiscanonlybereleasedbyamaintenaceperson(usingmaintenacekeyorpasswordinsoftware).Anadditionalhazardwarninglabelisalsoprovidedonthefrontoftheunitwarningofmechanicalhazardswithrobot.NoneLoseCDAoneitherOn-TrakorCMPNoeffectonotherpartsofsystemNANoneLosewateronOn-TrakorCMPProcessissue-noeffectonotherpartsofsystemNANoneLosepowertosystemSystemshutsdown,needtostartupNeedtopushbuttonsonFABSandOn-Traktore-energize,reactivateCMPfromscreenNoneBrokenwaferincleaningarea-operatorreachesintoretreivePossibleinjurypotentialfromCMProbotend-effectorenteringOn-Trakatloadstationandhittingemployee抯handifworkinginsideofareaSpinnercoverdoorisinterlockedtopreventexposuretomovingpartsinOn-Trak.CoverissoftwareinterlockedtoCMProbot.Hardwaremechanicallockandhazardwarninglabeltopreventaccesstohazard.NoneLosecommunicationbetweencentralprocessorandOn-Trak,CMPorFABSPossiblelossofcontrolofprocess,Feedbacksignalisprovidedtomainsystem,iflost-wouldsignalthatsystemisnotreadyandstopReferenceSection5.5.8foradiscussionconcerningtestingthesystemtodeterminetheconsequensofacomputerhardwarefailure.EMOhit-shutdownprocessProcessissueEMOrequiresmanualresetNoneReachintoCMPenvelopethrough1inchgapbetweenplasticguardaroundrobotandOn-TrakframePossibleinjuryGuardhasbeenrevisedsothatthereisnogapandnoaccesstorobotfromOnTraksideNoneReachthroughFABSlightcurtaintoFABSloadingstationPosssibleinjurypotentialfromCMProbotGuardispresentwith0.5inchgapforwafertransferandhazardwarninglabelprovided.NoneOpenCMProbotaccesscoverwhenduringoperationPossibleinjuryfromCMProbot,oraccesstoOn-Trakmovingparts,orFABSrobotatloadingstationAccescoveristoolsecuredandprovidedwithahazardwaringlabelwhichwarnstoshutoffunitpriortoremovingcover.AppliedMaterialsshouldupdatethemanualstonotethepotentialhazardinvolvedandincludeproperproceudresforservicinhgthisarea.SeeSection5.4.5.RemoveCMPcoversProcessissue-mechanicalinjurypotentialforCMP,noeffectonrestofsystemNANoneHitstopbuttononFABS,CMPorOn-TrakStopsoperation=processissue-noeffectonrestofsystemLossofcommunicationsignal-sytemstopsNoneUseoftwoscreensonsystemduringmaintenanceactivitiesPossibleinjuryifemployeeworkinginsideofCMPandscreenoperatedfromthefrontbyFABSA-Bswitchprovidedwhichensuresthatonlyoneterminalcanbeactiveatatime.AppliedMaterialsshouldprovidealabelontheswitchindicatingwhichterminalisselectedoperatorconsoleormaintnenaceconsole.SeeSection5.4.5MaintenanceworkatlocalsystemrequiringLOTOPossibleinjuryifLOTOisnotfeasibleonsystemCanlockoutatcontrollerandatlocalCMPIncludeproceduresinmanualforMirraTrakonLOTOforsystem.SeeSectionAppliedMaterials,Model:MirraTrakSEMIS2-93AProductSafetyAssessment AttachmentEightPRIVATEATTACHMENTEIGHT-SEMIS10-1296RISKASSESSMENTGUIDELINEMETHODOLOGYAppliedMaterialsChemicalMechanicalPolishingSystemProductSafetyRiskAssessmentMethodologyIntroductionEachremainingIssueitemidentifiedbytheproductsafetyevaluationwassubjectedtoaRiskAssessmenttoassignanOverallRiskAssessmentCategory.TheapproachusedtodeterminetheRiskAssessmentCategoryforeachoftheseitemswasbaseduponSEMIS10-1296,揝afetyGuidelinesforRiskAssessment”.Usingthismethodology,twocomponentswereassessed;SeverityandLikelihood.SeveritylevelswererankedbyGS3baseduponthelevelssummarizedinTable1.Table4providessomeexpandedexamplesofhazardsandseverityaffectingbothhumansandequipment.Examplesofelectrical,mechanical,chemicalandradiationhazardsareprovided.EachitemwasalsoassignedaLikelihoodlevelbaseduponthefivelevelsinTable2.AppliedMaterialsprovidedGS3withHazardLikelihoodlevelsforeachremainingIssue.ThelikelihoodratinghasbeenassignedbyAppliedMaterialsbasedupontheirexperiencewithsystemsinstalledandoperatinginthefield.GS3hasnotperformedanindependentassessmentofthislikelihoodinformation.Likelihoodlevelsrangeinfrequencyfrommorethanfivetimesperyear(揊requent”)tolessthanonetimeintenyears(揢nlikely”).TheOverallRiskAssessmentCategorywasdeterminedbyusingtheCombinedSeverityandFrequencyAssessmentMatrixpresentedinTable3.UsingthismatrixandtheSeverityandLikelihoodlevels,anoverallriskcategorywasassignedtoeachissue.

Table1:HazardSeverityGroupsSeverityComponentsTheseveritycomponentwasratedonthebasisoffivelevelsasdefinedintheSEMIdocumentandwasassignedanumericallevelasshownbelow.SeverityLevelNumericalValueCatastrophic1Severe2Moderate3Minor4Table2:HazardLikelihoodGroupsLikelihoodComponentThelikelihoodcomponentwasratedonthebasisoffivelevelsasdefinedintheSEMIdocumentandwasassignedanalphabeticallevelasshownbelow.LikelihoodLevelAlphabeticalValueFrequentALikelyBPossibleCRarelyDUnlikelyE*Levels: A= Frequent: >5X/year B= Likely: >1X/year,<5X/peryear C= Possible: >1X/5years,<1X/year D= Rarely: >1X/10years,<1X/5years E= Unlikely: <1X/10years

Table3:OverallRiskAssessmentCategory-CombinedSeverityandFrequencyAssessmentMatrixCombinedHazardRankingTheoverallrankingwasbaseduponthetwocomponentsusingthefollowingmatrixfromtheSEMIdocument.Itemswhichwererankedonlyasa揕ow”or揝light”riskassessmentcategorymaybeconsideredasacceptablewithoutcorrectiveaction,baseduponcriteriaintheSEMIS10-1296Guideline.CombinedHazardRankingRiskAssessmentMatrixLikelihoodSeverityFrequent-ALikely-BPossible-CRarely-DUnlikely-E1.Catastrophic2.Severe3.Moderate4.MinorCritical=1A,2A,1BHigh=3A,2B,1CMedium=4A,3B,2C,1DLow=4B,4C,3C,3D,2D,2E,1ESlight=4D,4E,3E

ProductSafetyRiskAssessmentMethodologyTable4:ExpandedHazardandSeverityExamplesHazardHazardTypeSeverityElectricalMechanicalChemicalRadiationCatastrophicH:ElectrocutionParalysis/DeathArsinefatalityRadiationfatalityE:MainframefireStructuralfailureofmonolithToxic/FlammablereleaseintofabEMIfailsexhaustswitchingsystemSevereH:CutaneousburnEye/limblossHFbonedamageCataractsE:HeatExchangerframefir