Multi-stage safety interlocking control method based on special gas filling system

Abstract

The invention relates to a multi-stage safety interlocking control method based on a special gas filling system, and belongs to the technical field of biological medicine. The method comprises the following steps: relying on a special gas filling system, sequentially completing core parameter configuration calibration and personnel and equipment full-dimension verification, constructing equipment-level, system-level and remote-level multi-level interlocking levels according to a control range, and configuring exclusive interlocking logic for each operation mode, risk grades are divided and differentiated response actions are configured in combination with special gas characteristics and fault influences, meanwhile, double-person collaborative confirmation and high-risk operation forced management and control requirements are integrated, and finally automatic fault recognition, graded reset and whole-process information recording and storage after interlocking triggering are achieved. And a full-process interlocking control system from early-stage preparation, process management and control to fault handling is formed. And hierarchical, precise and closed-loop safety interlocking control in the special gas filling process is realized, and the filling control requirements of high-risk special gases such as C4F6 and the like can be met.

Description

Technical Field

[0001] This invention belongs to the field of biomedical technology, specifically relating to a multi-level safety interlock control method based on a special gas filling system. Background Technology

[0002] In high-end manufacturing fields such as semiconductors and solar cells, special gases (such as C4F6 and trimethylaluminum) are used as core process media in key processes such as thin film deposition and etching. These gases are often flammable, explosive, highly corrosive, and highly toxic. The safety and stability of their filling process directly determine the continuity of production and the safety of personnel and equipment. At the same time, the process must meet the stringent requirements for gas purity.

[0003] To ensure the safety of filling special gases, existing filling systems have been initially equipped with basic safety protection functions, but many technical bottlenecks still exist in practical applications: First, the interlocking control architecture has a single level and incomplete protection coverage. Existing systems mostly adopt simple interlocking logic of single-point triggering and unified response, without dividing the control scope into progressive levels. This makes it impossible to achieve differentiated control of individual equipment failures, system process anomalies, and overall risks in the plant area. For example, equipment-level failures such as insufficient instrument gas pressure and system-level failures such as gas leaks use the same response method, which either leads to excessive shutdowns affecting production or insufficient responses that create safety hazards. Furthermore, there is a lack of linkage mechanisms with overall protection systems such as plant earthquake monitoring and fire evacuation, making it difficult to form closed-loop protection in extreme scenarios. Secondly, the access control and operational adaptability are insufficient, and the risk prevention and control of human and equipment risks are weak. On the one hand, the division of operator access is too broad, and the scope of operation is not matched according to training qualifications and practical experience. This makes it easy for unauthorized personnel to touch high-risk functions such as parameter modification and fault reset. On the other hand, when the system operation mode (such as filling, manual, and automatic) is switched, the interlocking logic lacks dynamic adaptation. There is a risk of interlock failure in some modes, and no mandatory constraints are set for high-risk operations. Problems such as single-person misoperation and parameter verification omissions occur frequently, which can easily lead to accidents such as overpressure filling and gas leakage. Third, the fault response and handling mechanism is imperfect, making it difficult to balance safety and production efficiency. The existing system lacks differentiated design for fault response, and adopts a single shutdown or alarm action regardless of the degree of fault impact. This may interrupt production due to minor faults, or cause the risk to expand due to delayed response to serious faults. At the same time, after a fault occurs, manual investigation and location are required. The system lacks the function of automatically identifying fault types and accurately locating fault points, resulting in low investigation efficiency, long cycle, and no complete fault handling data records, making it difficult to trace the cause and optimize the process. Fourth, the parameter configuration and initial verification are inaccurate, and there are deviations in the safety benchmark. The interlock trigger thresholds and operating parameters of the existing system are mostly based on preset general scenarios, without fully taking into account the physicochemical properties of special gases (such as corrosivity, flammability and explosiveness) and specific filling process requirements, resulting in a mismatch between the parameters and the actual safety boundary. In addition, there is a lack of full-dimensional verification of the operator's qualifications and the initial state of the equipment, which can easily lead to safety accidents due to hidden dangers such as unqualified personnel operation, aging equipment components, and pipeline sealing failure.

[0004] In summary, existing special gas filling systems are technically inadequate in terms of interlocking architecture, access control, fault handling, and parameter adaptation, and can no longer meet the core requirements of "high safety, high stability, and high precision" for special gas filling in the high-end manufacturing field. Summary of the Invention

[0005] To address the aforementioned problems in the existing technology, this invention provides a multi-level safety interlock control method based on a special gas filling system. The objective of this invention can be achieved through the following technical solution: include: S1: Configure core operating parameters and calibrate sensor data; preset interlock trigger benchmarks and operating parameter thresholds; implement hierarchical management of operation permissions, divide permission levels and configure operation scope; perform full-dimensional verification of operator permissions and the initial state of the special gas filling system. S2: Divide the interlocking levels according to the control scope, preset the triggering conditions, execution actions and inter-level linkage and coverage rules for each level; configure the corresponding interlocking logic for each operation mode, the interlocking logic is automatically loaded when switching modes, and the operation conditions are pre-verified before switching, and switching can only be performed after the verification is passed. S3: Based on the characteristics of special gases and the scope of fault impact, classify the risk level of interlocking signals and configure differentiated response actions; at the same time, integrate the requirements of two-person collaboration and double confirmation into the interlocking system; and set up mandatory confirmation procedures for high-risk operations. S4: After the interlock is triggered, the fault type is automatically identified, the fault point is located, and troubleshooting steps are pushed; after the fault is eliminated, a graded reset is performed according to the risk level, and trial operation monitoring is carried out after the reset; at the same time, the entire process information of the interlock is recorded and stored.

[0006] Specifically, the process of setting the preset interlocking trigger benchmark and the operating parameter threshold is as follows: Based on the physicochemical properties of the special gases and in accordance with the safety standards for the filling process, key parameters affecting the safe operation of the system are configured. Preset the stable fluctuation range of each parameter under normal filling conditions, obtain the safe operating boundary of each type of parameter, and set the interlock trigger benchmark standard corresponding to each type of fault.

[0007] Specifically, the process of dividing permission levels and configuring operation scope is as follows: Based on the operator's job parameters and the risk level of the operation, different permission levels are defined; Each level has a preset operating range. Basic-level users can only execute basic commands, intermediate-level users can execute intermediate commands, and advanced-level users can execute all advanced commands.

[0008] Specifically, the process of performing full-dimensional verification is as follows: When verifying operator permissions, compare the match between the operator's identity and the permissions granted, obtain training and assessment records, and preset the corresponding safety procedures for the operation. When verifying the initial state of a special gas filling system, the consistency between the core operating parameters and preset thresholds is compared to obtain the accuracy of sensor data acquisition, the integrity of equipment components, and the sealing performance of pipelines.

[0009] Specifically, the process of dividing the interlocking levels according to the scope of control is as follows: Based on the control boundaries of the special gas filling system operation, the interlocking system is divided into three levels: equipment level, system level, and remote level. The device cascade interlocks correspond to individual devices and components, the system cascade interlocks cover the overall system operation process, and the remote cascade interlocks connect to the global protection system, with preset control objects and core targets at each level.

[0010] Specifically, the process of executing actions based on the preset trigger conditions at each level and the linkage and overriding rules between levels is as follows: The equipment interlock is pre-set to trigger conditions such as insufficient instrument air pressure and abnormal valve opening and closing, which will lock the pneumatic valve circuit of the faulty component accordingly. The system-level interlock is pre-set to trigger conditions such as excessive gas leakage, insufficient purging pressure, or substandard vacuum, which will interrupt the process and close all associated valves accordingly. The remote cascaded interlock is preset to trigger conditions such as the action of the dual sensors of the seismograph, a fire in the factory area, or a remote shutdown signal, and will correspondingly cut off the liquid and gas supply and link the factory evacuation and waste gas treatment systems. The system pre-sets a rule that, when triggered by a lower-level element, it sends an early warning to the upper-level element, and when triggered by the upper-level element, it directly cuts off the lower-level loop and overrides all operation commands.

[0011] Specifically, the process of configuring the corresponding interlocking logic for each operating mode is as follows: The operating modes include filling mode, manual mode, and automatic mode; The filling process operates in the following order: cylinder pressure holding, pipeline purging to meet standards, and filling. The process is interrupted if the pressure or weight data is abnormal. The preset manual mode is entered after authorization verification. Individual valve operations undergo risk checks. When exiting manual mode, all pipeline valves are automatically closed. In automatic mode, the sensor continuously collects real-time data. When a fault signal is triggered, the process is directly interrupted, the pipeline valve is closed, and an alarm is activated.

[0012] Specifically, the process of classifying the risk levels of interlocking signals and configuring differentiated response actions is as follows: Based on the degree of danger of special gases and the impact of malfunctions, interlocking signals are divided into three levels; The first level corresponds to faults that do not affect safety but only slow down efficiency, and the response is a touch screen prompt, a soft alarm, and data recording; The second level is classified as a fault that may interrupt the process or has potential hidden dangers. The response is to suspend the process, push out troubleshooting instructions, and lock the operation interface. The third level corresponds to faults that threaten personal safety and cause equipment damage. The response is to stop the system, close all valves, cut off the gas supply, activate audible and visual alarms, and activate emergency facilities.

[0013] Specifically, the process of integrating the requirements for two-person collaboration and dual confirmation into the interlocking system is as follows: The system presets a two-person confirmation interlocking node. After the main operator completes the key steps, the system initiates a confirmation command and automatically pushes a checklist containing equipment status and process parameters. The system allows users to log in with a separate account to complete the verification and confirmation process. The system records the identity information and confirmation time of the two operators in real time. Once both confirmations are completed, the process lock is released; if confirmation is not completed within the timeout period, the interlocked state is automatically maintained.

[0014] Specifically, the process of setting up a mandatory confirmation procedure for high-risk operations is as follows: A high-risk operation mandatory confirmation trigger node is preset. After the trigger is triggered, the operator's permissions are automatically verified, and standardized check items for the status of related equipment and process parameters pop up and the initial screening of sensor data is completed. After completing the basic operations, submit the confirmation command and complete the identity verification. Log in to the system to review the verification items and sensor data and submit the confirmation command. The system automatically records operation information. Once confirmed, the system unlocks the subsequent process execution loop; otherwise, it keeps the process loop locked.

[0015] Specifically, the process of automatically identifying the fault type, locating the fault point, and pushing out troubleshooting steps after the interlock is triggered is as follows: After the interlock is triggered, the special gas filling system collects pressure, leakage, valve status data and operation logs, and compares them with the fault feature database to determine the fault type; By combining pipeline layout and component distribution, faulty components or pipelines can be located through data tracing. The system pushes out a step-by-step troubleshooting process, including closing the corresponding valve, identifying the loose or faulty parts, adjusting parameters, and verifying the results.

[0016] Specifically, the process of performing a graded reset according to risk level after the fault is cleared is as follows: The first-level fault is reset by the on-site operator, and operation is restored after the parameters are compared to the preset threshold range. The second-level fault is preset to be reset after the operator applies for it and the supervisor obtains the processing record and parameters. For a pre-set Level 3 fault, the operator applies, the supervisor reviews, and the remote monitoring confirms the fault. The special gas filling system verifies the core parameters and resumes the process once the pre-set range is reached.

[0017] The beneficial effects of this invention are as follows: (1) By setting up a three-level interlocking hierarchy of equipment-system-remote level, hierarchical management of operator permissions, and full-process full-dimensional verification mechanism, coupled with precise interlocking trigger benchmarks and operating parameter thresholds preset based on the physical and chemical properties of special gases and filling process standards, progressive safety control is achieved from individual equipment components to the overall system process and then to the overall protection of the plant area; the hierarchical permission strictly limits the operating scope of personnel with different qualifications to avoid unauthorized personnel from touching high-risk functions; the full-dimensional verification doubles the checks on personnel qualifications and the initial state of equipment to eliminate human error and equipment hazards; the three-level interlocking hierarchy covers various fault scenarios, and accurately executes actions such as locking components, interrupting processes, and linking emergency response according to the trigger conditions, effectively preventing safety accidents such as gas leakage, overpressure filling, and equipment malfunction, comprehensively improving the safety, standardization and reliability of the special gas filling process, and adapting to the high purity and high safety requirements of the semiconductor industry for special gas filling; (2) By setting up a risk level-differentiated response mechanism based on the impact of faults and gas characteristics, a dual-person collaborative double confirmation and a high-risk operation mandatory confirmation procedure, combined with the operation mode-specific interlocking logic and the whole-process fault closed-loop processing and data recording mechanism, the system can achieve precise prevention and efficient handling of special gas filling risks; the differentiated response adapts to the fault level with prompts, pauses, emergency cut-off and other actions, which not only avoids production interruption caused by over-response, but also prevents safety risks caused by insufficient response; the dual-person confirmation and mandatory confirmation build a solid defense line from the human operation level and eliminate high-risk accidents caused by single-person misoperation; the fault closed-loop processing significantly shortens the fault handling time and reduces production losses by automatically identifying fault types, locating fault points, pushing investigation steps and grading reset; the whole-process data recording provides a reliable basis for fault tracing, system maintenance and process optimization, ensures the long-term stable operation of the system, and fully meets the dual requirements of safety and efficiency in high-risk scenarios of special gas filling. Attached Figure Description

[0018] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0019] Figure 1 This is a flowchart illustrating a multi-level safety interlock control method based on a special gas filling system according to the present invention. Figure 2 This is a data flow diagram of a multi-level safety interlock control method based on a special gas filling system according to the present invention; Figure 3 This is a diagram of the user interface of the special gas filling system in this invention. Detailed Implementation

[0020] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided.

[0021] Please see Figure 1-3 A multi-level safety interlock control method based on a special gas filling system; include: S1: Configure core operating parameters and calibrate sensor data; preset interlock trigger benchmarks and operating parameter thresholds; implement hierarchical management of operation permissions, divide permission levels and configure operation scope; perform full-dimensional verification of operator permissions and the initial state of the special gas filling system. S2: Divide the interlocking levels according to the control scope, preset the triggering conditions, execution actions and inter-level linkage and coverage rules for each level; configure the corresponding interlocking logic for each operation mode, the interlocking logic is automatically loaded when switching modes, and the operation conditions are pre-verified before switching, and switching can only be performed after the verification is passed. S3: Based on the characteristics of special gases and the scope of fault impact, classify the risk level of interlocking signals and configure differentiated response actions; at the same time, integrate the requirements of two-person collaboration and double confirmation into the interlocking system; and set up mandatory confirmation procedures for high-risk operations. S4: After the interlock is triggered, the fault type is automatically identified, the fault point is located, and troubleshooting steps are pushed; after the fault is eliminated, a graded reset is performed according to the risk level, and trial operation monitoring is carried out after the reset; at the same time, the entire process information of the interlock is recorded and stored.

[0022] In this embodiment, the core operating parameters refer to the key process and equipment parameters that directly affect the safe operation, filling quality, and process stability of the special gas filling system, specifically including: Filling parameters: cylinder filling pressure, filling weight, filling time, purging pressure, number of purging cycles, vacuum level, and pressure holding time; Equipment operating parameters: instrument air pressure, panel heating temperature, heating temperature during source gas analysis, valve opening and closing frequency, exhaust pressure / exhaust volume; Safety control parameters: gas leak detection concentration, overflow switch setting value, cylinder connection interface pressure, and discharge pipe (VENT) pressure.

[0023] In this embodiment, sensor data refers to the raw data collected in real time by the system through various sensors, reflecting the equipment status, filling process, and environmental conditions, specifically including: Pressure sensing data: real-time pressure values ​​of each pipeline (cylinder side, delivery side, purging side), pressure change data during pressure holding, and instrument gas pressure monitoring data; Weight sensor data: Weight data of the cylinder before and after filling, and real-time weight change data during the filling process; Safety monitoring data: Leak concentration data collected by gas leak detectors, environmental data collected by smoke / heat / UV open flame detectors, and exhaust volume data collected by exhaust pressure sensors; Status feedback data: valve switch status feedback data, heating module real-time temperature data, and overflow switch trigger status data.

[0024] In this embodiment, the interlock triggering benchmark refers to the core judgment criteria for determining whether a safety interlock is triggered, specifically including: gas leakage concentration benchmark (such as whether the leakage concentration exceeds the safety limit), pressure anomaly benchmark (such as whether the pressure exceeds the allowable range of the filling process), equipment status benchmark (such as whether the valve is in position and whether the sensor is working properly), and process compliance benchmark (such as whether the number of purgings meets the standard and whether the pressure holding is qualified). Operating parameter thresholds: These refer to the safety boundary values ​​set for core operating parameters, specifically including: pressure thresholds (upper and lower limits of filling pressure, minimum value of instrument gas pressure, and purging pressure compliance value), weight thresholds (set value of cylinder full weight and limit of weight change rate), time thresholds (filling timeout limit, minimum holding time, and purging time range), and concentration thresholds (gas leak alarm threshold and upper limit of permissible concentration of toxic gases).

[0025] In this embodiment, the special gas characteristics refer to the physical and chemical properties of the special gas itself, specifically including: flammability and explosiveness (whether it is a flammable / explosive gas, ignition energy), corrosivity (whether it has a strong corrosive effect, compatibility with pipeline / valve materials), toxicity (whether it is a toxic gas, toxicity level), purity requirements (specific standards for gas purity in the process), and state characteristics (physical state, viscosity, and volatility at room temperature and pressure). Scope of impact of failure: refers to the objects and scope that may be affected after a system failure, specifically including: impact on personnel safety (whether it threatens the personal safety of operators, and the size of the impact), impact on equipment operation (whether it causes damage to a single component or shutdown of the entire system), impact on production progress (whether it interrupts the filling process, and the time required for recovery), and environmental impact (whether it causes gas leakage pollution, or whether it triggers secondary risks such as fire / explosion).

[0026] Specifically, the process of setting the preset interlocking trigger benchmark and the operating parameter threshold is as follows: Based on the physicochemical properties of the special gases and in accordance with the safety standards for the filling process, key parameters affecting the safe operation of the system are configured. Preset the stable fluctuation range of each parameter under normal filling conditions, obtain the safe operating boundary of each type of parameter, and set the interlock trigger benchmark standard corresponding to each type of fault.

[0027] Specifically, the process of dividing permission levels and configuring operation scope is as follows: Based on the operator's job parameters and the risk level of the operation, different permission levels are defined; Each level has a preset operating range. Basic-level users can only execute basic commands, intermediate-level users can execute intermediate commands, and advanced-level users can execute all advanced commands.

[0028] Specifically, the process of performing full-dimensional verification is as follows: When verifying operator permissions, compare the match between the operator's identity and the permissions granted, obtain training and assessment records, and preset the corresponding safety procedures for the operation. When verifying the initial state of a special gas filling system, the consistency between the core operating parameters and preset thresholds is compared to obtain the accuracy of sensor data acquisition, the integrity of equipment components, and the sealing performance of pipelines.

[0029] Specifically, the process of dividing the interlocking levels according to the scope of control is as follows: Based on the control boundaries of the special gas filling system operation, the interlocking system is divided into three levels: equipment level, system level, and remote level. The device cascade interlocks correspond to individual devices and components, the system cascade interlocks cover the overall system operation process, and the remote cascade interlocks connect to the global protection system, with preset control objects and core targets at each level.

[0030] Specifically, the process of executing actions based on the preset trigger conditions at each level and the linkage and overriding rules between levels is as follows: The equipment interlock is pre-set to trigger conditions such as insufficient instrument air pressure and abnormal valve opening and closing, which will lock the pneumatic valve circuit of the faulty component accordingly. The system-level interlock is pre-set to trigger conditions such as excessive gas leakage, insufficient purging pressure, or substandard vacuum, which will interrupt the process and close all associated valves accordingly. The remote cascaded interlock is preset to trigger conditions such as the action of the dual sensors of the seismograph, a fire in the factory area, or a remote shutdown signal, and will correspondingly cut off the liquid and gas supply and link the factory evacuation and waste gas treatment systems. The system pre-sets a rule that, when triggered by a lower-level element, it sends an early warning to the upper-level element, and when triggered by the upper-level element, it directly cuts off the lower-level loop and overrides all operation commands.

[0031] Specifically, the process of configuring the corresponding interlocking logic for each operating mode is as follows: The operating modes include filling mode, manual mode, and automatic mode; The filling process operates in the following order: cylinder pressure holding, pipeline purging to meet standards, and filling. The process is interrupted if the pressure or weight data is abnormal. The preset manual mode is entered after authorization verification. Individual valve operations undergo risk checks. When exiting manual mode, all pipeline valves are automatically closed. In automatic mode, the sensor continuously collects real-time data. When a fault signal is triggered, the process is directly interrupted, the pipeline valve is closed, and an alarm is activated.

[0032] Specifically, the process of classifying the risk levels of interlocking signals and configuring differentiated response actions is as follows: Based on the degree of danger of special gases and the impact of malfunctions, interlocking signals are divided into three levels; The first level corresponds to faults that do not affect safety but only slow down efficiency, and the response is a touch screen prompt, a soft alarm, and data recording; The second level is classified as a fault that may interrupt the process or has potential hidden dangers. The response is to suspend the process, push out troubleshooting instructions, and lock the operation interface. The third level corresponds to faults that threaten personal safety and cause equipment damage. The response is to stop the system, close all valves, cut off the gas supply, activate audible and visual alarms, and activate emergency facilities.

[0033] Specifically, the process of integrating the requirements for two-person collaboration and dual confirmation into the interlocking system is as follows: The system presets a two-person confirmation interlocking node. After the main operator completes the key steps, the system initiates a confirmation command and automatically pushes a checklist containing equipment status and process parameters. The system allows users to log in with a separate account to complete the verification and confirmation process. The system records the identity information and confirmation time of the two operators in real time. Once both confirmations are completed, the process lock is released; if confirmation is not completed within the timeout period, the interlocked state is automatically maintained.

[0034] Specifically, the process of setting up a mandatory confirmation procedure for high-risk operations is as follows: A high-risk operation mandatory confirmation trigger node is preset. After the trigger is triggered, the operator's permissions are automatically verified, and standardized check items for the status of related equipment and process parameters pop up and the initial screening of sensor data is completed. After completing the basic operations, submit the confirmation command and complete the identity verification. Log in to the system to review the verification items and sensor data and submit the confirmation command. The system automatically records operation information. Once confirmed, the system unlocks the subsequent process execution loop; otherwise, it keeps the process loop locked.

[0035] Specifically, the process of automatically identifying the fault type, locating the fault point, and pushing out troubleshooting steps after the interlock is triggered is as follows: After the interlock is triggered, the special gas filling system collects pressure, leakage, valve status data and operation logs, and compares them with the fault feature database to determine the fault type; By combining pipeline layout and component distribution, faulty components or pipelines can be located through data tracing. The system pushes out a step-by-step troubleshooting process, including closing the corresponding valve, identifying the loose or faulty parts, adjusting parameters, and verifying the results.

[0036] Specifically, the process of performing a graded reset according to risk level after the fault is cleared is as follows: The first-level fault is reset by the on-site operator, and operation is restored after the parameters are compared to the preset threshold range. The second-level fault is preset to be reset after the operator applies for it and the supervisor obtains the processing record and parameters. For a pre-set Level 3 fault, the operator applies, the supervisor reviews, and the remote monitoring confirms the fault. The special gas filling system verifies the core parameters and resumes the process once the pre-set range is reached.

[0037] In this embodiment, based on the actual control boundaries of the filling system, a three-level interlocking system of equipment level, system level, and remote level is built through PLC logic programming. Dedicated triggering conditions and execution actions are preset for each level, while linkage and coverage rules between levels are set. In actual operation, the equipment-level interlocking automatically locks the pneumatic valve circuit of the faulty component through sensor data monitoring. The system-level interlocking directly interrupts filling and closes all associated valves when an abnormality is detected in the process. The remote-level interlocking connects to the plant's fire protection and earthquake monitoring systems, and upon triggering, it links to complete power supply cutoff and emergency facility activation. Linkage between levels is achieved through a signal transmission module. When a lower-level interlock is triggered, it automatically transmits a warning signal to the upper level. When an upper-level interlock is triggered, it directly cuts off the lower-level action circuit through the program, covering all operation commands.

[0038] In this embodiment, high-risk operation types requiring two-person collaboration, such as cylinder filling and cylinder purging, are first identified in the system. A two-person double confirmation system is established through system permission management and operation process programming. In actual operation, after the main operator completes the key operation steps, the system automatically pushes a checklist to the site. After the supervisor completes the on-site item-by-item verification, he logs into his own authorized account to complete the confirmation operation in the system. The system records the operation information of both people in real time. If double confirmation is not completed, the process will be automatically locked and cannot continue. At the same time, a mandatory confirmation node is set for high-risk operations in the system. Before the operation starts and the core steps are executed, the system automatically pauses the process and pops up the checklist. The process can only continue after the operator completes the item-by-item confirmation of parameters, equipment, environment and other information. The entire process realizes operation permission verification and operation behavior recording through the system.

[0039] In this embodiment, combining the physicochemical properties of special gases with the actual impact of faults, the system classifies fault levels and configures differentiated response actions through system data modeling. Simultaneously, a fault feature database is built, and automatic fault identification and location are achieved through the sensor data acquisition module. In actual operation, the system intelligently compares real-time collected sensor data such as pressure and valve status with the fault feature database to quickly determine the fault type and locate the fault point. It also pushes step-by-step troubleshooting steps to guide on-site handling. After the fault is eliminated, a combination of real-time sensor data monitoring and manual on-site verification confirms no residual safety hazards. Then, a graded reset operation is performed according to the fault level. After reset, the system automatically detects core operating parameters and initiates trial operation monitoring. The entire process of interlock triggering, processing, reset, and recovery is recorded through the data storage module, achieving closed-loop fault handling and data traceability.

[0040] This embodiment uses C4F6 gas filling as an application scenario. C4F6 is flammable and explosive, and has stringent requirements for filling accuracy and sealing. The implementation process is as follows: Combining the physicochemical properties of C4F6 with filling process standards, core operating parameters are set through the system parameter configuration module, including filling pressure a MPa, target filling weight b kg, purging pressure c MPa, and vacuum degree d Pa. Simultaneously, a standard calibrator is used to perform zero-point and accuracy calibration on sensors for pressure, weight, leak detection, and valve status, ensuring that sensor data acquisition errors are within acceptable limits. Interlock trigger benchmarks and operating parameter thresholds are preset, setting the C4F6 leak concentration eppm as the core trigger benchmark for leak-related interlocks, and setting upper and lower limits for filling pressure (a±f MPa) and minimum instrument pressure (g MPa) as threshold parameters. An account permission management system is used to divide permissions into basic, intermediate, and advanced levels, configuring exclusive operating ranges for each level. Finally, a full-dimensional verification is performed to confirm the matching degree between the operator's qualifications and acquired permissions. Simultaneously, the system automatically completes h initial state verifications, including parameter and threshold consistency, pipeline sealing performance, and sensor acquisition accuracy. After all verifications are passed, system initialization is completed, and the system enters the pre-filling state.

[0041] Based on the control boundaries of the C4F6 filling system, a three-level interlocking system of equipment, system, and remote levels is built through PLC programming. The trigger conditions, execution actions, and linkage rules of each level are preset: at the equipment level, when the instrument gas pressure is lower than gMPa or the valve switch feedback is abnormal, the pneumatic valve circuit of the faulty component is immediately locked; at the system level, when the C4F6 leakage concentration exceeds e ppm or the purging pressure does not reach c MPa, the filling process is interrupted and all related valves are closed within i seconds; at the remote level, when a fire or earthquake signal is received in the plant area, the gas supply is cut off and the plant exhaust gas treatment and evacuation system are linked; at the same time, it is set that a warning signal is transmitted to the upper level within j seconds after the lower level interlock is triggered, and when the upper level interlock is triggered, the lower level action circuit is directly cut off and all operation commands are overridden.

[0042] Dedicated interlocking logic is configured for three operation modes: filling, manual, and automatic. The filling mode is programmed with the following logic: cylinder micro-pressurization and pressure holding for k minutes → panel purging once to meet the standard → formal filling. Before switching to any mode, the system automatically completes m pre-verification of operating conditions. If the verification passes, the interlocking logic of the corresponding mode is automatically loaded. If the verification fails, the switching is prohibited.

[0043] Based on the flammable and explosive characteristics of C4F6 and the impact of its malfunctions on filling, the interlock signals are divided into three risk levels. Differentiated response actions are configured through PLC programming: Level 1 is for malfunctions with no safety risk, such as minor weight fluctuations or slight deviations in exhaust pressure, which only trigger a text prompt on the touchscreen and a soft alarm; Level 2 is for malfunctions that may interrupt the process, such as insufficient purging pressure or failure to maintain pressure, which immediately suspend the filling process, push troubleshooting instructions, and lock the operating interface; Level 3 is for high-risk malfunctions such as C4F6 leakage exceeding e ppm or filling pressure exceeding the upper limit, which within i seconds stop all system operations, close all valves, cut off the gas supply, trigger an audible and visual alarm, and link the on-site emergency ventilation facilities.

[0044] The interlocking system incorporates the requirements for dual-person collaboration and dual confirmation. A mandatory confirmation procedure is also set up for the high-risk C4F6 filling operation: After the main operator logs into their account and completes the cylinder connection and pipeline docking, they click "Main Operator Confirmation" on the touchscreen. The system automatically pops up a checklist of n items, including cylinder model matching, interface sealing status, and the availability of protective equipment. After the supervisor verifies each item on-site, they log into their dedicated account and click "Supervisor Confirmation." The system records both accounts and the confirmation time. If dual confirmation is not completed, the process is automatically locked. Before the filling operation starts, the system will also forcefully pop up 0 checklist items. The operator must check each item to confirm that the parameters, equipment, and environment are normal before the process can proceed.

[0045] When the interlock is triggered, the system collects sensor data such as pressure, leakage, and valve status, as well as recent operation logs in real time through the data acquisition module. It then performs intelligent comparison with the C4F6 filling-specific fault feature database, completing fault type identification and fault location within p seconds. At the same time, it pushes targeted step-by-step troubleshooting steps to the touch screen. For example, for a leakage fault, it pushes the operation steps of "closing the main valve of the cylinder → checking the pipeline joints and seals → reconnecting and then detecting the leakage concentration".

[0046] After the fault is handled, real-time monitoring of sensor data and on-site manual verification are used to confirm that there is no C4F6 residue and no safety hazards in the equipment. Then, a graded reset is performed according to the risk level: For the first level fault, the on-site operator directly clicks the "Reset" button on the touch screen. After the system detects that the core parameters are stable for q minutes, the filling process is resumed. For the second level fault, the operator submits a reset application. The supervisor logs into the system to check the fault handling record and the current parameters, and then clicks "Approve Reset" to resume. For the third level fault, the operator submits an application, the supervisor reviews it, and the remote monitoring personnel confirm that all three parties agree. The system then comprehensively checks r core parameters. After all parameters meet the standards and are stable for s minutes, the system resumes normal operation. After the reset, the system automatically starts trial operation monitoring, which lasts for t minutes.

[0047] Throughout the filling process, the system records parameter configuration, sensor data, operation confirmation, fault triggering and handling, and graded reset information in real time through the data storage module. All data is saved for u cycles, enabling the entire C4F6 filling process to be traceable and verifiable.

[0048] In this embodiment, the special gas filling system is the core hardware carrier and command execution entity for the entire implementation of this method. It is specifically designed for filling special gases such as C4F6, which have requirements for flammability, explosiveness, strong corrosivity, and high purity. It is composed of a sensor acquisition unit, a PLC control unit, a pneumatic execution unit, an access control unit, a data storage unit, and a sealed filling pipeline module. The sensor acquisition unit realizes real-time and accurate acquisition of multi-dimensional data such as pressure, weight, and leakage concentration, providing data support for parameter calibration and interlock triggering. The PLC control unit, as the core computing module, carries out all command operations and logical judgments, including logic programming, fault feature comparison, and risk classification response. The pneumatic execution unit completes actions such as valve opening and closing, filling start and stop, and loop locking according to control commands. The access control unit realizes operator identity verification, access classification, and operation scope control. The data storage unit is responsible for recording, retaining, and traceable management of information such as operation, faults, and parameters throughout the entire process. The sealed filling pipeline module ensures the sealing of the special gas filling process.

[0049] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A multi-level safety interlock control method based on a special gas filling system, characterized in that, include: S1: Configure core operating parameters and calibrate sensor data, preset interlock trigger benchmarks and operating parameter thresholds; Implement hierarchical management of operational permissions, classify permission levels and configure operational scopes; conduct full-dimensional verification of operator permissions and the initial state of the special gas filling system. S2: Divide the interlocking levels according to the control scope, preset the triggering conditions, execution actions and inter-level linkage and coverage rules for each level; configure the corresponding interlocking logic for each operation mode, the interlocking logic is automatically loaded when switching modes, and the operation conditions are pre-verified before switching, and switching can only be performed after the verification is passed. S3: Based on the characteristics of special gases and the scope of fault impact, classify the risk level of interlocking signals and configure differentiated response actions; at the same time, integrate the requirements of two-person collaboration and double confirmation into the interlocking system; and set up mandatory confirmation procedures for high-risk operations. S4: After the interlock is triggered, the fault type is automatically identified, the fault point is located, and troubleshooting steps are pushed; after the fault is eliminated, a graded reset is performed according to the risk level, and trial operation monitoring is carried out after the reset; at the same time, the entire process information of the interlock is recorded and stored.

2. The method according to claim 1, characterized in that, The specific process of setting the preset interlocking trigger benchmark and operating parameter threshold is as follows: Based on the physicochemical properties of the special gases and in accordance with the safety standards for the filling process, key parameters affecting the safe operation of the system are configured. Preset the stable fluctuation range of each parameter under normal filling conditions, obtain the safe operating boundary of each type of parameter, and set the interlock trigger benchmark standard corresponding to each type of fault.

3. The method according to claim 1, characterized in that, The specific process of dividing permission levels and configuring operation scope is as follows: Based on the operator's job parameters and the risk level of the operation, different permission levels are defined; Each level has a preset operating range. Basic-level users can only execute basic commands, intermediate-level users can execute intermediate commands, and advanced-level users can execute all advanced commands.

4. The method according to claim 1, characterized in that, The specific process for performing full-dimensional verification is as follows: When verifying operator permissions, compare the match between the operator's identity and the permissions granted, obtain training and assessment records, and preset the corresponding safety procedures for the operation. When verifying the initial state of a special gas filling system, the consistency between the core operating parameters and preset thresholds is compared to obtain the accuracy of sensor data acquisition, the integrity of equipment components, and the sealing performance of pipelines.

5. The method according to claim 1, characterized in that, The specific process for dividing the interlocking levels according to the scope of control is as follows: Based on the control boundaries of the special gas filling system operation, the interlocking system is divided into three levels: equipment level, system level, and remote level. The device cascade interlocks correspond to individual devices and components, the system cascade interlocks cover the overall system operation process, and the remote cascade interlocks connect to the global protection system, with preset control objects and core targets at each level.

6. The method according to claim 1, characterized in that, The specific process of executing actions based on the preset trigger conditions at each level and the linkage and overriding rules between levels is as follows: The equipment interlock is pre-set to trigger abnormal valve switching conditions, which will lock the pneumatic valve circuit of the faulty component. The system-level interlock is set to trigger conditions where gas leakage exceeds a preset range, which will interrupt the process and close all associated valves accordingly. The remote cascaded interlock is preset to trigger conditions such as the action of the dual sensors of the seismograph, a fire in the factory area, or a remote shutdown signal, and will correspondingly cut off the liquid and gas supply and link the factory evacuation and waste gas treatment systems. The system pre-sets a rule that, when triggered by a lower-level element, it sends an early warning to the upper-level element, and when triggered by the upper-level element, it directly cuts off the lower-level loop and overrides all operation commands.

7. The method according to claim 1, characterized in that, The specific process for configuring the corresponding interlocking logic for each operating mode is as follows: The operating modes include filling mode, manual mode, and automatic mode; The filling process operates in the following order: cylinder pressure holding, pipeline purging to meet standards, and filling. The process is interrupted if the pressure or weight data is abnormal. The preset manual mode is entered after authorization verification. Individual valve operations undergo risk checks. When exiting manual mode, all pipeline valves are automatically closed. In automatic mode, the sensor continuously collects real-time data. When a fault signal is triggered, the process is directly interrupted, the pipeline valve is closed, and an alarm is activated.

8. The method according to claim 1, characterized in that, The specific process of classifying the risk level of interlocking signals and configuring differentiated response actions is as follows: Based on the degree of danger of special gases and the impact of malfunctions, interlocking signals are divided into three levels; The first level corresponds to a safety fault, and the response is a touch screen prompt, a soft alarm, and data recording. The second level corresponds to interrupted processes and potential faults, and the response is to pause the process, push out troubleshooting instructions, and lock the operation interface. The third level corresponds to the damaged equipment failure, and the response is to stop the system, close all valves, cut off the gas supply, sound and light alarms, and activate emergency facilities.

9. The method according to claim 1, characterized in that, The specific process of integrating the requirements for dual-person collaboration and dual confirmation into the interlocking system is as follows: The system presets a two-person confirmation interlocking node. After the main operator completes the key steps, the system initiates a confirmation command and automatically pushes a checklist containing equipment status and process parameters. The system allows users to log in with a separate account to complete the verification and confirmation process. The system records the identity information and confirmation time of the two operators in real time. Once both confirmations are completed, the process lock is released; if confirmation is not completed within the timeout period, the interlocked state is automatically maintained.

10. The method according to claim 1, characterized in that, The specific process for setting up a mandatory confirmation procedure for high-risk operations is as follows: A high-risk operation mandatory confirmation trigger node is preset. After the trigger is triggered, the operator's permissions are automatically verified, and standardized check items for the status of related equipment and process parameters pop up and the initial screening of sensor data is completed. After completing the basic operations, submit the confirmation command and complete the identity verification. Log in to the system to review the verification items and sensor data and submit the confirmation command. The system automatically records operation information. Once confirmed, the system unlocks the subsequent process execution loop; otherwise, it keeps the process loop locked.

11. The method according to claim 1, characterized in that, The specific process of automatically identifying the fault type, locating the fault point, and pushing out troubleshooting steps after the interlock is triggered is as follows: After the interlock is triggered, the special gas filling system collects pressure, leakage, valve status data and operation logs, and compares them with the fault feature database to determine the fault type; By combining pipeline layout and component distribution, faulty components or pipelines can be located through data tracing. The system pushes out a step-by-step troubleshooting process, including closing the corresponding valve, identifying the loose or faulty parts, adjusting parameters, and verifying the results.

12. The method according to claim 1, characterized in that, The specific process for performing graded reset according to risk level after the fault is eliminated is as follows: The first-level fault is reset by the on-site operator, and operation is restored after the parameters are compared to the preset threshold range. The second-level fault is preset to be reset after the operator applies for it and the supervisor obtains the processing record and parameters. For a pre-set Level 3 fault, the operator applies, the supervisor reviews, and the remote monitoring confirms the fault. The special gas filling system verifies the core parameters and resumes the process once the pre-set range is reached.

Images