Configurable Distributed Interlocking System

Abstract

To provide a method and apparatus for providing human safety and machine safety and operation.SOLUTION: In one example, a distributed interlock system includes at least one master device coupled to several slave devices. The slave device receives a signal from one or more tools and provides the signal to the master device. The master device evaluates the signal and prevents the unsafe condition before one or more command executions for the unsafe condition are transmitted to one or more of the slave devices. Other methods and systems are disclosed.SELECTED DRAWING: Figure 1A

Description

[Background technology]

[0001] [Priority claim] This application claims the benefit of priority to U.S. Patent Application No. 62 / 667,865, filed May 7, 2018, which is incorporated herein by reference in its entirety. [Technical field]

[0002] The subject matter disclosed herein relates to a control system that provides operating signals and safety interlocks. More particularly, the subject matter disclosed relates to both machine safety and personnel safety around machine tools and tool-to-tool safety.

[0003] The current state of the art in today's control systems is relay-based safety interlocking. The fastest interlocking mechanism available on the market is the "Safety over EtherCAT" (Ethernet for Control Automation Technology) system. However, even with "Safety over EtherCAT" implementation, the evaluation of the interlock adds delays to the input / output (I / O) cycle time, making concurrent implementation unusable for advanced machine tool applications.

[0004] Currently, the EtherCAT standard is an Ethernet-based fieldbus system. One version of the system is available from Beckhoff Automation (Beckhoff Automation GmbH & Co. KG; Huelshorstweg 20, 33415 Verl, Germany). The protocol for such systems is standardized in the International Electrotechnical Commission (IEC) standard 61158 and is used for both hard and soft real-time computing requirements in automation technology. Therefore, tools in semiconductor manufacturing environments currently typically have EtherCAT or other Ethernet-based control architecture connections built into or added to the tool. However, the simultaneous implementation of the EtherCAT standard and related technologies does not meet all the requirements for human safety and correct tool operation.

[0005] The information provided in this section is provided to provide those skilled in the art with a background to the subject matter disclosed below and should not be construed as acknowledged prior art. [Brief description of the drawings]

[0006] [Figure 1A] FIG. 1 illustrates an example of a high-level overview of a Control Automation Technology (CAT) control system including a distributed interlock (ITLK) system component in accordance with various illustrative embodiments.

[0007] [Figure 1B] FIG. 2 illustrates another example of a high level overview of a CAT control system including distributed interlock (ITLK) system components in accordance with various exemplary embodiments.

[0008] [Diagram 2] FIG. 1 illustrates an example of an overview of a node package in accordance with various illustrative embodiments.

[0009] [Diagram 3] FIG. 1 illustrates an example of a high level overview of a distributed interlocking system in accordance with various illustrative embodiments.

[0010] [Figure 4A] FIG. 1 illustrates an example of a system interlock in accordance with various exemplary embodiments.

[0011] [Figure 4B] FIG. 1 illustrates an example of a system interlock regarding feedback comparing actual output values ​​to expected output values, in accordance with various exemplary embodiments.

[0012] [Figure 4C] FIG. 1 illustrates an example of adding a system interlock in accordance with various exemplary embodiments.

[0013] [Diagram 5] FIG. 2 illustrates an example of deterministic latency and synchronization inputs and outputs, in accordance with various exemplary embodiments.

[0014] [Figure 6A] FIG. 1 illustrates an example of an inhibit interlock in accordance with various exemplary embodiments.

[0015] [Figure 6B] FIG. 1 illustrates an example of a preventative interlock in accordance with various exemplary embodiments.

[0016] [Figure 7] FIG. 1 illustrates an example of a dual redundancy of a distributed interlock system in accordance with various illustrative embodiments.

[0017] [Figure 8] FIG. 1 illustrates an example of separating firmware and interlock equations in a distributed interlock system in accordance with various illustrative embodiments.

[0018] [Figure 9]FIG. 1 illustrates an example of a system architecture for daisy-chaining communications between multiple master devices in accordance with various exemplary embodiments.

[0019] [Figure 10] FIG. 2 is a three-dimensional view of an exemplary embodiment of a gas distribution box having several gas distribution conduits attached thereto and utilizing various embodiments of the presently disclosed subject matter.

[0020] [Figure 11A] FIG. 2 is a three-dimensional view of an exemplary embodiment of a gas distribution box having external EtherCAT node connections connected to various gas distribution components inside the gas distribution box.

[0021] [Figure 11B] 11B is another three-dimensional view of the exemplary embodiment of the gas distribution box of FIG. 11A, showing another view of the various gas distribution components present within the gas distribution box. FIG.

[0022] [Figure 11C] FIG. 11B shows an exemplary embodiment of a portion of an EtherCAT connector for system communication according to FIG. 11A.

[0023] [Figure 11D] FIG. 11B shows an exemplary embodiment of another part of an EtherCAT connector for system communication according to FIG. 11A.

[0024] [Figure 12] FIG. 1 is a simplified block diagram of a machine, an exemplary form of computing system that may execute a set of instructions to cause the machine to perform any one or more of the methods and operations discussed herein. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0025] The disclosed subject matter will now be described in detail with reference to several general and specific embodiments, as illustrated in various embodiments in the accompanying drawings. In the following description, numerous specific details are set forth in order to provide a thorough understanding of the disclosed subject matter. However, it will be apparent to one skilled in the art that the disclosed subject matter may be practiced without all or some of these specific details. In other instances, well-known process steps or structures are not described in detail in order not to obscure the disclosed subject matter. Specific names for abbreviations and acronyms used herein are as follows:

[0026] ASIC: Application Specific Integrated Circuit

[0027] CAT: Control automation technology

[0028] DI: Digital input

[0029] DO: Digital output intended to drive

[0030] EtherCAT: Ethernet for control automation technology

[0031] FPGA: Field Programmable Gate Array

[0032] ITLK: Interlock

[0033] EtherCAT: A specific exemplary embodiment of a hardware platform capable of executing EtherCAT protocol software and / or firmware and conforming to the EtherCAT standard as developed by the IEEE 802 standard.

[0034] RS-485: A well-known serial communications protocol (also known as Telecommunications Industry Association standard TIA-485 and Electronic Industries Association standard EIA-485) is a standard that defines the electrical characteristics of drivers and receivers used in serial communications systems, and is presented herein primarily for ease of understanding. Those skilled in the art will recognize, upon reading and understanding the disclosure set forth herein, that other types of communications protocols may also be used.

[0035] SBC: Single Board Computer

[0036] SO: Expected output value

[0037] SI: Actual output value (SO reading)

[0038] Type 5: An example of one type of interface conversion card, although one of ordinary skill in the art will recognize upon reading and understanding the disclosure set forth herein that other types of interface cards may be readily substituted.

[0039] The disclosed subject matter evidences distributed interlocks that are verified as safe according to the IEC 61508 standard. The distributed interlock system disclosed herein allows any DI and any DO to be used in the interlock calculations throughout the system. As an example, an Overheat OK DI from the bottom of a module can be used to interlock heater power from being enabled on the top of a module on another node. This is accomplished without routing DIOs between nodes. Additionally, preventative interlocks evaluate the state of the interlocks and prevent dangerous conditions before executing a command. The interlocks are configurable, for example, firmware, which allows any or all equations to be updated without the need to redesign, for example, printed circuit boards (PCBs) and / or cables, and without the need for hardware recertification.

[0040] In various exemplary embodiments, the distributed interlock system disclosed herein evaluates the interlock equations in substantially real-time via field programmable gate arrays (FPGAs) or application specific integrated circuits (ASICs), or other controller or processor types, or other components known in the prior art, configured in a master-slave configuration (or multiple interconnected masters, at least as part of multiple masters with their own sets of slave devices) with only one cycle time of the EtherCAT backbone. As a result, the distributed interlock system is proactive rather than reactive, and the system performs without adding delays to I / O execution cycles.

[0041] The distributed interlock system disclosed herein thus enables distributed interlocks for the entire system that are proactively evaluated and substantially evaluated in real time. In various embodiments, the interlock equations may be firmware configurable, thereby eliminating routine hardware changes and associated safety recertification. As a result, the disclosed distributed interlock system enables significant development cycle time reductions and cost savings.

[0042] The disclosed subject matter contained herein generally relates to the operation of "tools" in a semiconductor manufacturing environment (fab). Such tools may include various types of deposition (such as plasma-based tools, such as ALD (atomic layer deposition), CVD (chemical vapor deposition), PECVD (plasma enhanced chemical vapor deposition)) and etching tools (e.g., reactive ion etching (RIE) tools), as well as various types of thermal furnaces (such as rapid thermal annealing and oxidation), ion implantation, and a variety of other processing and metrology tools found in various fabs and known to those skilled in the art. Additionally, certain tool components, such as gas supply boxes that provide various gases (including toxic and / or caustic gases) to the tool, may benefit from various of the embodiments disclosed herein. However, the disclosed subject matter is not limited to semiconductor environments, but may be used in many machine tool environments, such as robotic assembly environments, manufacturing environments, and machining environments.

[0043] Thus, every tool in a fab has one or more safety features and / or requirements due to possible threats to human safety or machine safety and operation. For example, interlock systems and various types of sensors are built into some tools or can be added to various tools. In one example, those skilled in the art know that radio frequency (RF) generators in plasma-based tools must be removed while performing maintenance on the RF generator. In another example, those skilled in the art know that two or more gases of a certain type may combust or have other types of dangerous interactions when mixed. As previously mentioned, the simultaneous implementation of the EtherCAT standard and related technologies does not meet all the requirements for human safety and correct tool operation.

[0044] For example, a distributed interlock system can consult a lookup table to determine if there is a particular combination of consecutive events that could be particularly detrimental to human safety or machine safety and operation, either at a single tool or between tools. In one specific example, one skilled in the art recognizes that silane (SiH4) is an inorganic, colorless, gaseous compound of silicon and hydrogen that has strong reducing properties and burns spontaneously in air. Thus, oxygen and silane can ignite or explode when mixed together. By storing such chemical reactions in a lookup table, the disclosed subject matter can prevent the valves that control the flow of these gases from mixing the gases. Thus, such chemical reactions can be prevented from ever happening, rather than simply reacting to conditions that have already occurred that could potentially cause a disaster. This "preventative" interlock operation is described in more detail below.

[0045] As disclosed herein, the disclosed subject matter can be configured to provide interlocks on all input / output (I / O) ports of a tool. Also, the disclosed subject matter can be proactive to prevent certain interactions and actions from occurring, as previously described, rather than simply shutting down a tool or I / O port after an action has already occurred. Thus, the disclosed subject matter can interface interlock software signals with hardware signals.

[0046] Various examples are provided with respect to a semiconductor manufacturing environment to facilitate understanding of the disclosed subject matter, however, upon reading and understanding the disclosure set forth herein, one of ordinary skill in the art will recognize that the distributed interlock system of the present disclosure may be used in a wide variety of environments that utilize different types of tools, multiple tools, or other machines.

[0047] Referring now to FIG. 1A, an example high-level overview of a Control Automation Technology (CAT) control system 100 including components of a distributed interlock (ITLK) system is shown, according to various exemplary embodiments. FIG. 1A shows a master device 101, several slave nodes 105A-105C (which may include, for example, a tool or a part of a tool, such as a gas supply box or an individual component within a tool), and an interlock master 111. FIG. 1A shows three slave nodes for illustrative purposes, although the number of slave nodes may be fewer (e.g., as few as one) or much more.

[0048] The master device 101 may be a single board computer (SBC) in an exemplary embodiment. The master device 101 may receive input from and provide output directly to one or more of the slave nodes 105A-105C. In various embodiments, one or more of the slave nodes 105A-105C may provide input to or receive output from the sequencer 103. Although the sequencer 103 is shown to include part of the master device 101, in other embodiments the sequencer 103 may be a stand-alone device (not shown). In embodiments, one or more of the slave nodes 105A-105C may provide input directly to or receive output directly from both the master device and / or the sequencer 103.

[0049] In various embodiments, sequencer 103 may be a firmware-based or software-based component. The sequencer may be "running" on a master device or a stand-alone device. In an embodiment, the sequencer may be a hardware-based device implemented, for example, in one or more field programmable gate arrays (FPGAs) or one or more application specific integrated circuits (ASICs), or other controller or processor type components known in the prior art.

[0050] The sequencer 103 can be used, for example, to analyze sequences of events that occur within a tool or between various tools (e.g., interactions between tools). These interactions can include, for example, tracking inputs and when such inputs turn on (e.g., with respect to time or with respect to another event) and tracking when output responses occur (e.g., with respect to time or with respect to another event).

[0051] Each of the slave nodes 105A-105C is shown to include an interface conversion card 107 and an interlock (ITLK) slave device 109. As shown in FIG. 1A, the interface conversion card 107 is shown to be a Type 5 device as is known in the prior art. However, those skilled in the art will recognize upon reading and understanding the disclosure set forth herein that other types of interface cards may be readily substituted. The ITLK slave device 109 receives an input signal DI and provides an actual output signal SI. The actual output signal SI is the actual value of the output signal, which is a reading of the output signal SO.

[0052] As shown, each of the slave nodes 105A-105C is connected to an interlock master 111. In various embodiments, the interlock master 111 may be configured in accordance with RS-485 or a related standard, although it is not required that the interlock master 111 implements RS-485 or a related standard.

[0053] Overall, the CAT control system 100, including components of a distributed interlock (ITLK) system, provides DI / DO interlocks at the interfaces throughout the system, as will be described in more detail below.

[0054] FIG. 1B illustrates another example of a high-level overview of a CAT control system 130 including components of a distributed interlock (ITLK) system, according to various exemplary embodiments. In this embodiment, the sequencer is configured to block all incoming and outgoing signals from slave nodes 105A-105C. FIG. 1B further illustrates two ITLK slave devices in slave node 105A: output ITLK slave device 113A and input ITLK slave device 1133B. As illustrated in FIG. 1B, output ITLK slave device 113A provides an actual output signal SI. As previously described with respect to ITLK slave device 109, actual output signal SI is the actual value of the output signal, which is a reading of output signal SO. Also illustrated, ITLK slave device 113B receives input signal DI.

[0055] In various embodiments, the system of Figures 1A and 1B provides an interlock master module for centralized interlock calculations and solving of interlock equations. All of the interlock equations may be included in, for example, the master device 101, the interlock master 111, or a combination of the two, but the disclosure is not limited to only these devices. In one embodiment, each of the ITLK slave devices 109, 113A, 113B is a remote I / O device. In a particular exemplary embodiment, the ITLK slave devices 109, 113A, 113B can manage 64 DIs and 64 DOs or more per device, can be daisy-chained with one or more other of the ITLK slave devices 109, 113A, 113B, each with expandable I / O, can have the same hardware and firmware for rapid compatibility, and can withstand 500mA or more of current per output.

[0056] Various combinations of CAT control system 100 including components of the distributed interlock (ITLK) system of Figure 1A and CAT control system 130 of Figure 1B may be used. The high level overview merely provides an overview of two possible system architectures. Further details of the CAT control system are described below.

[0057] FIG. 2 illustrates an example of an overall node package 200 (e.g., a node module) according to various exemplary embodiments. FIG. 2 illustrates a connector board 201 that includes an interface conversion card 203, a first DIO ITLK board 205, and a second DIO ITLK board 207. The interface conversion card 203 is connected to the ITLK slave device 105 of FIGS. 1A and 1B. A 1A and 1B. The first DIO ITLK board 205 and the second DIO ITLK board 207 may be substantially the same as the ITLK slave device 109 of FIG.

[0058] As shown in the particular exemplary embodiment depicted in FIG. 2, the interface conversion card 203 may be a Type 5 device as known in the prior art. However, those skilled in the art will recognize upon reading and understanding the disclosure set forth herein that other types of interface cards may be readily substituted. The interface conversion card 203 is coupled to a first DIO ITLK board 205, which is coupled to a second DIO ITLK board 207, for example, via a serial peripheral interface (SPI) communication channel. In this embodiment, the interface conversion card 203 is also coupled to an EtherCAT connection and is shown to receive as many as 32 analog inputs (AIs) and transmit up to 32 analog outputs (AOs). However, the number of AI and AO channels is provided by way of illustration only and is not limited to 32 AIs and 32 AOs.

[0059] 2, first DIO ITLK board 205 and second DIO ITLK board 207 may each have up to 64 digital inputs (DIs) and 64 digital outputs (DOs) per board, which can be further expanded by connecting them in a daisy chain manner, although the number of DI and DO channels is provided by way of illustration only and is not limited to 64 DIs and 64 DOs.

[0060] Also as shown, the first DIO ITLK board 205 and the second DIO ITLK board 207 are each coupled to an interlock master, for example, of FIG. 1A or FIG. 1B, by, for example, an RS-485 interface. Although not explicitly shown, additional DIO ITLK boards may be incorporated. The first DIO ITLK board 205 and the second DIO ITLK board 207 are each capable of withstanding a current of 500mA or more per output. In a particular exemplary embodiment, the first DIO ITLK board 205 and the second DIO ITLK board 207 may each be configured to withstand a load of 7A or more and protect inputs and outputs from shorts to ground, and further protect to −15V and +24V. These voltage and current ratings are for illustration only and are not limited to the values ​​shown.

[0061] Based on the description provided herein, and as described in further detail below, the distributed interlock system of the disclosed subject matter provides at least the following interaction and safety features: (1) It is a preventative system interlock, -Local DI / DO means no longer limited to a node - It is possible to link the intention of driving the output. (2) Flexibility - Any DO in the system can be interfaced with any DI or DO. (3) Configurability - the interlock equations can be easily and quickly modified. (4) Predictability - The system has deterministic interlocked response times. (5) Safety - The system complies with safety integrity level 3 (SIL3) as defined in the IEC 61508 standard and is a dual redundant system. (6) Visibility - The system can be easily integrated with a Graphical User Interface (GUI) that has, for example, start-up operations and diagnostic utilities for troubleshooting. A representative GUI is described in more detail below.

[0062] In certain exemplary embodiments, the GUI may display various items such as the operational state of each node in the system, the DI and DO states of each component in the system, expected interlocked outputs compared to actual interlocked outputs, and the AI ​​and AO states of the various components of the system. The exemplary GUI can be used to switch DOs and configure AOs, plot and analyze AIO, DIO, and SIO waveforms, for example, and upload and download all or selected portions of EtherCAT object status.

[0063] An exemplary GUI may also provide an "EtherCAT view" showing, for example, the SIOs and the SIO user interface. The EtherCAT view can be configured to provide diagnostics and troubleshooting, for example, during a start-up event ("boot") or in the event of an error. The EtherCAT view can also be configured to report the status of every single DIO and SIO in the system, can command DOs "on" or "off," and can highlight and / or color-code SO and SI mismatches to indicate what type of mismatch has occurred.

[0064] Additionally, the EtherCAT view can be configured to provide plotting tools that can trace, draw and save the waveforms of any signal in the system. Such plotting tools are useful for analyzing sequences, for example to trace inputs and when the inputs are turned on and when the associated output responses occur. Each of the various types of GUIs and EtherCAT views uses tools that are known and understood by those skilled in the art.

[0065] The distributed interlock system of the disclosed subject matter further provides certain features, as previously mentioned and described in more detail below, which in certain exemplary embodiments include at least the following: (1) Dual-redundant systems with pre-certified hardware; (2) A serial communications system, such as RS-485, between a master (or multiple masters) and one or more slaves in a communications protocol; (3) A preventative interlock that can also be used to link the intention to drive the output; (4) Deterministic interlock latency, e.g., less than 1 millisecond (msec), which is independent of some interlock equations; (5) Input sampling and output driving are synchronized. (6) A maximum capacity of 5,000 or more for interlock instructions.

[0066] 3, an example high-level overview of a distributed interlock system 300 is shown, in accordance with various exemplary embodiments. The high-level overview of the distributed interlock system 300 is merely an illustrative example to provide an overall theory of operation and is shown to include a motherboard 301 and several daughterboards 303A-C, which are configured in a master / slave architecture. Although only three daughterboards are shown, the distributed interlock system 300 is not limited to three; more or fewer daughterboards may be used.

[0067] The master, here motherboard 301, contains the centralized interlock equation solving section. All interlock equations may be stored, for example, in a non-volatile memory device (e.g., a flash memory device) within the motherboard 301. The motherboard 301 may be the same or nearly the same as the master device 101 of Figures 1A and 1B.

[0068] Each of the slave devices, here the daughterboards 303A-303C, may be substantially the same or identical to each other. Also, each of the daughterboards 303A-303C may be the same or substantially the same as the ITLK slave device 109 of FIG. 1A and FIG. 1B. In an embodiment, each of the daughterboards 303A-303C may be identified by a unique identifier (ID) provided, for example, by a connector board, to uniquely address a particular one of the daughterboards 303A-303C. As a slave device, each of the daughterboards 303A-303C may simultaneously sample received inputs and transmit the received inputs to the motherboard 301 as a master device. Furthermore, each of the daughterboards 303A-303C may simultaneously drive outputs based on results or instructions received from the motherboard 301.

[0069] FIG. 4A illustrates an example of a system interlock 400 according to various exemplary embodiments. FIG. 4A is shown including a master device 401 and several slave devices 403A-403C. Each of the master device 401 and slave devices 403A-403C may be the same or similar to other master and slave devices identified herein, such as the master device 101 and ITLK slave nodes 105A-105C of FIGS. 1A and 1B. In this example of system interlock 400, any DO in the system may be interlocked by some combination of DO and DI.

[0070] For example, with continued reference to Figure 4A, an example of logic (E0 SO 32 = (E0 DI 0) & (E1 DI 14) & (E2 DI 66)) is provided from a master device 401 sending and receiving signals to three slave devices 403A-403C (also labeled E0, E1, and E2 in Figure 4A). In various embodiments, the three slave devices 403A-403C are all connected together (e.g., via one or more field connection boards on each tool) and controlled by the distributed interlock system disclosed herein.

[0071] FIG. 4B illustrates an example of a system interlock 430 with feedback comparing actual output values ​​to expected output values, according to various exemplary embodiments. In FIG. 4B, an intended digital output from the master is sent to a board on the tool to drive a specific operation (e.g., DO is an input to the tool). A safe output (expected value at that output) is monitored and fed back as an actual output value (i.e., reading SO). If the two values ​​are not the same, or are within some predetermined tolerance level for a given operation or tool, for example, the distributed interlock system disclosed herein can revert to a safe mode when necessary for a given operation and / or tool. The distributed interlock system can run considering multiple inputs (e.g., thousands or more), such as DO signals from other software and / or hardware, to ensure that all software and hardware provide safe operation.

[0072] 4C illustrates another example of a system interlock 450 according to various exemplary embodiments. In FIG. 4C, a master device 401 and three slave devices 403A-403B are shown. CIn this example logic, (E0 SO 32=(E0 DI 0)&(E1 DI 14)&(E2 DI 66)) is provided from the master device 401 which is sending and receiving signals to the three slave devices 403A-403C. In another example logic, E1 SO 44=(E0 SO 32) would be as would be understood by one skilled in the art.

[0073] FIG. 5 shows an example of deterministic latency and synchronization inputs and outputs according to various exemplary embodiments of the master-slave architecture 500, and associated graphs showing the start and end time of measurements for each of the SIOPs E0, E1, and E2. In certain exemplary embodiments, the deterministic response time may be updated every millisecond (msec) or less, regardless of the number of interlock equations and / or commands and / or operations involved. Thus, in this embodiment, the response time (e.g., from the time something is needed to the time something is executed) is less than 1 msec. In the case of a semiconductor fab, a synchronous output can drive all nodes in the fab and / or sub-fabrication (or process line) to commands issued at the same time. The synchronous output driving all nodes (e.g., box-to-box) may have a maximum output-to-output jitter of, for example, approximately 100 nanoseconds (nsec).

[0074] FIG. 6A illustrates an example of an inhibitory interlock, and FIG. 6B illustrates an example of a preventative interlock, each according to various exemplary embodiments. As described herein, the disclosed distributed interlock system has both inhibitory and preventative interlocks, whereas prior art systems do not have preventative interlocks. For example, as depicted in FIG. 6A, the inhibitory system allowed two gas valves to be turned on approximately simultaneously for 520 microseconds (μsec) and then both turned off. Meanwhile, the preventative system of FIG. 6B, as part of the distributed interlock system disclosed herein, prevented either gas valve from turning on even if both valves were commanded from DO1 and DO2, respectively. The preventive interlock portion of the distributed interlock system may incorporate various types of lookup tables, such as those described above, to prevent valves from opening even if a signal to turn on is sent on command.

[0075] 6A and 6B, the interlock system has the ability to interlock the intent to drive an output, which is based on the state of the input and the intent to drive the output. Thus, the system prevents the system from driving outputs that cannot be turned on at the same time due to equipment safety and / or human safety issues (such as the above example of a combination of oxygen and silane that could ignite or explode).

[0076] Continuing with the example in Figure 6A, D O 1 and D O Assume that 2 is the intended input signal. Furthermore, S O 1 and S O Assume that 2 is the output signal after relay interlock. D O 1 and D O When both signals S and S are set to "1" simultaneously, the interlocked output signal S O 1 and S O 2 shows a 520μsec glitch as the relay times out to turn off.

[0077] 7 illustrates an example of a dual redundancy 700 of a distributed interlock system according to various exemplary embodiments. The distributed interlock system can be configured to have at least one dual redundancy, for example with two FPGAs on each board (both the master and all slaves) to perform the same tasks. The FPGAs are for illustrative purposes only and can be substituted or supplemented with one or more of the other devices discussed herein, such as one or more ASICs.

[0078] As shown in FIG. 7, the interlock master 701 has a first redundancy module A and a second redundancy module B. A first ITLK slave device 703A and a second ITLK slave device 703B are shown to each have a first redundancy module A and a second redundancy module B (elements labeled 705A, 705B, 705C, and 705D, respectively). As previously mentioned, each module may include a variety of hardware devices (e.g., FPGAs, ASICs, processors, etc.), firmware devices (e.g., electronic devices that can be programmed to execute specific code), or software-based devices that control specific physical devices and associated input and output signals. Programmability considerations are described in more detail below.

[0079] In one embodiment, each redundant device on each board may be programmed to perform the same tasks, for example, if a first redundant module A fails, a second redundant module B automatically takes over the tasks of the first redundant module.

[0080] In another embodiment, a first redundancy module A drives an output signal and an output device. The other redundancy module reads the output signal, compares it to its own results, and shuts off the output signal if there is a discrepancy within a predetermined limit. In some examples, the predetermined limit may be zero.

[0081] In this embodiment, all of the management and control equations (and any look-up tables) may be maintained in the interlock master 701. In this example, a first ITLK slave device 703A (the "A" part) performs the actual "actuation" such as switching a valve, and a second ITLK slave device 703B (the "B" part) performs the signal reading, highlights any discrepancies (within predetermined limits), and may return the slave and associated tools to a safe state as previously described. Thus, in this embodiment, the distributed interlock system incorporates "communication" between "A" and "B" to validate commands and other I / O signals.

[0082] For example, with respect to FPGA programmability, some considerations in certain exemplary embodiments include the following. (1) Separate the interlock equations from the FPGA's firmware (FW). a. FPGA FW The i.FPGA FW may be configured to perform various functions of the system. ii. The FPGA FW can be pre-certified and does not necessarily need to be changed if the equations are changed, so no re-certification is required. b. Interlock equation: i. Interlock equations are specific to the system's use case. ii. The interlock equation can be changed without the need to re-certify the FPGA FW. iii. Tool safety recertification is still used. (2) Programmability can be designed for IEC 61508 certification.

[0083] FIG. 8 illustrates an example of separation of firmware and interlock equations in a distributed interlock system according to various exemplary embodiments. FIG. 8 illustrates an interlock master unit 801. The interlock master unit 801 may be the same or substantially the same as other master devices described herein. The interlock master unit 801 includes a first FPGA 803A and a second FPGA 803B. Each of the first FPGA 803A and the second FPGA 803B is coupled to a non-volatile memory device 807A, 807B and a firmware device 805A, 805B, respectively.

[0084] Non-volatile memory devices 807A, 807B may be any non-volatile memory device known in the prior art described herein, such as flash memory devices, conductive bridging random access memory (CBRAM), programmable metallization cell (PMC), phase change memory (PCM), and other non-volatile memory types known in the prior art. Devices configured to be programmed as firmware devices are known in the prior art (e.g., semiconductor chips or integrated circuits configured with firmware and devices configured to receive firmware updates).

[0085] In a particular exemplary embodiment, the FW components may be stored in firmware devices 805A, 805B and programmed via their own headers. Firmware devices 805A, 805B may consist of a single firmware device containing two files or two separate firmware devices, each with one file for the respective FPGA 803A, 803B. The FW files of each firmware device 805A, 805B may be identical, but stored at different addresses. Interlock equations are stored in non-volatile memory devices 807A, 807B. An interface, such as an SPI communication channel, may couple the non-volatile memory devices 807A, 807B to the respective FPGAs 803A, 803B. Regardless of the particular configuration, the contents of the non-volatile memory devices 807A, 807B do not affect the functional FW stored in the respective firmware devices 805A, 805B.

[0086] In one example of the separation of firmware and interlock equations shown in FIG. 8, the end user can modify code (e.g., multi-use code) specific to the application of a controlled or controllable tool (e.g., a semiconductor processing tool such as ALD, CVD, PECVD, PVD, etc. or components located within or outside the tool). This modifiability is therefore an aspect of programmability. However, the functional code (e.g., drive A and read B as described above) may not generally be configurable by the end user to prevent unintended consequences that may result in loss of some or all of the safety features of the distributed interlock system described herein.

[0087] 9 illustrates an example of a system architecture 900 for daisy-chaining communications between multiple master devices in accordance with various exemplary embodiments. System architecture 900 can be used with any of the other systems described herein.

[0088] FIG. 9 shows several master devices 903A, 903B, 903C (master devices are also labeled M0, M1, and M2 in the drawings). Three master devices are shown for illustrative purposes, but more or less master devices may be used. Each of the master devices 903A, 903B, 903C has a master-to-slave communication portion 901A, 901B, 901C, respectively, and a master-to-master communication portion 905A, 905B, 905C, respectively. Each communication portion may be based on RS-485 communication protocol or other wired or wireless protocols and techniques known in the prior art. For example, Ethernet communication may be used between the master devices. In a particular exemplary embodiment, the master devices may communicate in a 100 Mbps (or higher) full duplex manner in a wired topology. There may also be an intervening network device or network configuration located between one or more of the master devices 903A, 903B, 903C. As with any of the master devices or systems described herein, the system can be configured to calculate any ITLK devices with possible delays, such as delays due to process tolerances or noise and / or bouncing signals. Such delays can avoid false trips or false alarms in the system.

[0089] For purposes of illustration, master device 903A is shown in electrical communication with multiple slave devices 907A (the slave devices are also labeled E0, E1, E2, and E3 in the drawings). Each slave device 903A may be an ITLK slave, for example, in a single tool, or may be physically distributed among several tools, including all tools located in one or more process lines. Although four slave devices are shown for purposes of illustration, more or fewer slave devices may be used. Additionally, each of master devices 903A, 903B, 903C may be coupled to multiple slave devices (not shown) so as not to obscure the disclosed subject matter.

[0090] In an exemplary embodiment, with regard to shared IO operations between various ones of the master devices 903A, 903B, 903C: (1) Any DI or DO in any node can be shared with any master device (e.g., any DIO in any master device can work with any other DIO in any other master device). (2) Ethernet Shared IO (XIO) transmissions of more than 1 Gbps for various types of communication can occur to the Reduced Media Independent Interface (RMII), Gigabit Media Independent Interface (GMII), Reduced Gigabit Media Independent Interface (RGMII), Serial Gigabit Media Independent Interface (SGMII), Quad Serial Gigabit Media Independent Interface (QSGMII), and 10 Gigabit Media Independent Interface (XGMII), all of which are full-duplex communication methods. (3) The firmware may have a common reflective memory space for each master device. a. Each master device has memory space allocated for XIO. b. The memory data of the XIO is updated every interlock calculation cycle. c. After the master data exchange is completed, all XIO memories can have the same contents. (4) Each master “knows” where it is in the chain and can read the link status of the physical layer (PHY). (5) Each master device can have a unique ITLK table that describes, for example, how many slave devices are coupled to the master device and describes the SO logic that is local to each master (e.g., can use DIO from any slave). (6) Each master device knows when to add or remove based on the ITLK table - there is no set connection order.

[0091] In various exemplary embodiments, the detailed reflective memory transmission may include: (1) Reflection memory updates occur once per interlock computation cycle. (2) This update may be initiated, for example, by the first and last master devices in the chain after receiving the last slave data; and (3) The data is forwarded down the chain until all the data has been received.

[0092] As with other system embodiments described herein, each interlock master can execute functional firmware (or its hardware equivalent). Each interlock master can also execute application firmware (interlock logic firmware). Functional firmware refers to the code that runs the system, e.g., serial communications, system watchdog, and other functions. Application firmware refers to the interlock logic that is programmed into the unit and written by the end user. Examples of firmware are described herein and elsewhere in this disclosure.

[0093] In an embodiment, the application firmware may be automatically generated from a software parser that converts a human readable interlock logic table (e.g., from a spreadsheet) into multiple hex files, one hex file for each master used in the system as declared in the spreadsheet. These generated files are unique to each other and assign a Media Access Control (MAC) address to the master device that is being programmed. The generated file also declares which other MACs are in the system.

[0094] This MAC ensures that each master device knows exactly which other master devices it should receive information from. In a particular exemplary embodiment, any communication with a master device that is not declared in the interlock table may be treated as insecure. As a result, if master device "A" detects that it is connected to master device "B", which is not authorized in the system, master device "A" will treat input from master device "B" as insecure. This kind of organization can also be applied when connecting two identical master devices together.

[0095] In various embodiments, any collision that occurs between master devices may be treated as an unsafe condition and all communications between such master devices may subsequently be treated as unsafe, and the master devices may respond by discarding unsafe data to ensure the system is fail-safe at all times.

[0096] Interlock system for use with a gas supply box In this exemplary embodiment, the components of the interlock system are described as being usable with various types of gas distribution boxes. Gas distribution boxes (or gas panels) are used in semiconductor manufacturing facilities to supply multiple gases, for example, to a vacuum processing chamber to deposit or etch a film on a substrate. These gas distribution boxes contain mass flow controllers (MFCs) for multiple gases, one or more per gas. The MFCs and their associated components, such as valves, regulators, filters, and similar gas distribution components, are often attached to and bonded together in a "gas stick." Typically, many gas sticks (e.g., 3-30 or more) are used to supply gas to a process chamber, for example, in a semiconductor processing tool. Different runs in the process tool may use different gases, flows, and pressures.

[0097] Because most, if not all, gas distribution boxes supply hazardous or toxic gases, any interlock system used with the gas distribution box must prevent or minimize possible threats to human safety or machine safety and operability. In various embodiments, the interlock system may interface with various types of safety systems, such as the EtherCAT controllers discussed above.

[0098] In concurrent systems currently used in the semiconductor and related industries, the prior art is a gas distribution box with multiple analog wire connections to one or more multi-pin connectors, such as "D-type" connectors. The D-type connector has many cables leading to a central input / output controller (IOC) to send analog signals to and receive analog signals from gas components, such as MFC devices, and to power the MFCs. Additional analog signals are sent to and from additional gas flow components, such as pressure transducers and switches, and digital control and IOC signals are sent to and from pneumatic solenoids to communicate with a system controller. In time, power is provided to these and other components through the D-type connector.

[0099] As discussed above, interlocks are required to ensure that valve opening combinations that could cause hazardous conditions to either machine and / or personnel safety are minimized or prevented. Such interlocks are typically hardware-based, using, for example, jumper wires or specially designed interlocking printed circuit board assemblies.

[0100] In one example, a vacuum-based semiconductor manufacturing facility uses multiple gases delivered to a process chamber to apply and / or strip films from a substrate. The flow of gases is controlled by an MFC. Solenoid-based pneumatically actuated valves are used to open and close the various gas paths to the chamber to control the gas mixture inside the process chamber. The subject matter disclosed in this section is a gas delivery box, or gas delivery panel, with an integrated controller that communicates with a system controller, for example, via an EtherCAT interface.

[0101] In the case of interlocking, the EtherCAT controller integrated with the gas supply box can be a slave to an interlock master that must be connected to operate the gas box. The interlock master may perform the interlock function when connected to a module or system, or a 1:1 check interlock master.

[0102] The test interlock master allows the gas distribution box to be tested. It must be tested when the gas distribution box is first built. The 1:1 test interlock master always triggers a SO that corresponds to a DO without any interlocks. For example, in a tool, valve "A" could be silane and valve "B" O2. The tool's interlock master prevents "A" and "B" from opening at the same time. As a result, the test interlock master allows the verification of the full functionality of the gas distribution box. To verify the functionality, the test interlock master allows the user to cycle through each valve and check the operation of each one. For test purposes, the 1:1 test interlock master is free to operate any valve at any time since there is no safety issue during the test phase, since the slaves must execute the master inputs. Thus, any or all combinations in which the valves operate can be tested and verified.

[0103] The gas distribution box or gas panel can be controlled via a single EtherCAT interface. The single EtherCAT interface greatly simplifies the setup and testing of the gas distribution box. In various embodiments, the gas distribution box can be configured and tested via a single EtherCAT connection, thus eliminating the need for test equipment and problematic cabling and separate interface box or boxes of the prior art. Thus, the disclosed subject matter allows for easy integration into any gas distribution box, typically for coupling to a semiconductor processing tool, and can be pre-configured and tested to be "plug-and-play." The plug-and-play configuration allows for easy integration at the end user's site, thus enhancing the merge-in-transit (MIT) process. As known in the prior art, MIT is a process in which individual subsystems are shipped separately to the end user's site and then integrated to form a complete system at the end user's site. The disclosed subject matter further enhances the integration-to-order (ITO) process.

[0104] As described in detail herein, the EtherCAT (or similar) controller is part of the "hard structure" (the various gas flow components such as the gas distribution box MFCs, valves, etc.), which means that the EtherCAT controller can be quickly configured once the gas flow paths and gas flow components are configured, and the entire gas distribution box can be inspected through the EtherCAT interface. The EtherCAT controller can be pre-stored at the integration site along with the other gas distribution box components, without needing to know which gas distribution box needs to be integrated. By pre-locating the gas distribution box at the integration site as described, the lead time for the gas distribution box can be reduced, for example, from approximately 8-10 weeks to about 1-2 weeks. The significantly reduced lead time provides a proportional cost savings while providing a quick turnaround to end users of semiconductor manufacturing and related equipment.

[0105] 10, a three-dimensional view 1000 of an exemplary embodiment of a gas supply box 1005 having several gas supply conduits attached thereto and utilizing various embodiments of the disclosed subject matter is shown. The gas supply box 1005 can be configured to accommodate several gas supply conduits to supply gas to one or more facility gas inlet supply lines of various types of plasma-based etching and deposition equipment, such as those used in the semiconductor and allied industries. For example, in various embodiments, the gas supply box 1005 can be configured with fewer than 10 conduits, 10-20 conduits, or more than 20 conduits, each of which can be coupled to a different gas supply, such as a different precursor gas. The gas supply box 1005 includes a backplane 1001 to which various components of the disclosed subject matter can be attached (e.g., screwed or otherwise physically or chemically attached or bonded) as is known in the art. Gas supply box 1005 is shown containing multiple gas component conduits 1003 (e.g., "gas sticks") in which gas supply components (e.g., valves, mass flow controllers, pressure transducers, pressure regulators, etc.) are positioned.

[0106] The backplane 1001 of the gas distribution box 1005 is also shown with several other components. The backplane 1001, housings, printed circuit boards, electrical cables, pneumatic banks, and other components discussed herein (not all of which are necessarily shown) are all known in the prior art.

[0107] 11A shows a three-dimensional view 1100 of an example embodiment of a gas distribution box 1005 having an external EtherCAT node connection 1150 connected to various gas distribution components inside the gas distribution box 1005. The three-dimensional view 1100 also shows several MFCs 1111 and several gas distribution components 1113 (e.g., lock-out / tag-out (LOTO) valves, pressure regulators, gas filters, two-port valves, three-port valves, etc.). Each of the many MFCs is electrically coupled by an MFC communication line 1109.

[0108] The external EtherCAT node connection 1150 is shown to include an EtherCAT connector area 1103 that allows communication between components inside the gas supply box 1005 and a remote controller (not shown), an access port 1101 that allows access to the internal communication components of several gas supply boxes (which are shown and described in further detail below in FIG. 11B ), and an interlock master connector area 1170.

[0109] The interlock master connector area 1170 is also shown to include a connector port 1105, for example for coupling to an interlock master, and an additional connector port 1107, for example for coupling to an external exhaust sensor (in a particular exemplary embodiment, the additional connector port 1107 may be a DB-9 port for digital and / or analog communications).

[0110] Figure 11B is another three-dimensional view 1130 of the exemplary embodiment of the gas distribution box 1005 of Figure 11A, showing another view of the various gas distribution components within the gas distribution box 1005. The three-dimensional view 1130 shows internal communication components 1131 within the gas distribution box 1005, which are accessible from the access port 1101 of Figure 11A. The internal communication components 1131 provide digital and / or analog communication between a remote controller (not shown) and various of the gas distribution components within the gas distribution box 1005 (e.g., the MFC 1111 and the various gas distribution components 1113).

[0111] Figure 11C illustrates an exemplary embodiment that is part of an external EtherCAT node connection 1150 for system communication according to Figure 11A and includes an EtherCAT connector area 1103. The EtherCAT connector area 1103 is shown to include, for example, a number of indicator lights 1151 (e.g., for verifying power supply, EtherCAT diagnostics, fan operation, etc.), as well as one or more EtherCAT connectors 1153 for communication with a system controller (not shown) and the gas supply box 1005 of Figures 10, 11A, and 11B. In certain exemplary embodiments, the one or more EtherCAT connectors 1153 may include RJ-45 connectors as known in the prior art.

[0112] FIG. 11D shows another portion of the external EtherCAT node connection 1150 (see FIGS. 11A and 11B) and an exemplary embodiment including an interlock master connector area 1170 for system communication according to FIG. 11A.

[0113] A machine that has instructions to perform various operations 12 is a block diagram illustrating components of a machine 1200 according to some embodiments that can read instructions from a machine-readable medium, such as a non-transitory machine-readable medium, a machine-readable storage medium, a computer-readable storage medium, or any suitable combination thereof, and can perform any one or more of the methodologies discussed herein. In particular, FIG. 12 is a diagram of the machine 1200 in the exemplary form of a computer system within which instructions 1224 (e.g., software, programs, applications, applets, apps, or other executable code) may be executed to cause the machine 1200 to perform any one or more of the methodologies discussed herein.

[0114] In alternative embodiments, the machine 1200 operates as a stand-alone device. Alternatively, it may be connected (e.g., networked) to other machines. In a networked deployment, the machine 1200 may operate in the capacity of a server machine or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The machine 1200 may be a server computer, a client computer, a personal computer (PC), a tablet computer, a laptop computer, a netbook, a set-top box (STB), a personal digital assistant (PDA), a mobile phone, a smart phone, a web appliance, a network router, a network switch, a network bridge, or any machine capable of executing instructions 1224, which instructions are executed sequentially or which specify actions to be taken by the machine. Moreover, although only a single machine is described, the term "machine" should be construed to include a collection of machines that individually or collectively execute the instructions 1224 to perform any one or more of the methods discussed herein.

[0115] The machine 1200 includes a processor 1202 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a radio frequency integrated circuit (RFIC), or any suitable combination thereof), a main memory 1204, and a static memory 1206, which are configured to communicate with each other via a bus 1208. The processor 1202 may include microcircuits that are temporarily or permanently configurable by some or all of the instructions 1224 such that the processor 1202 is configurable to, in whole or in part, perform any one or more of the methods discussed herein. For example, a set of one or more microcircuits of the processor 1202 may be configurable to execute one or more modules (e.g., software modules) described herein.

[0116] The machine 1200 may further include a graphics display 1210 (e.g., a plasma display panel (PDP), a light emitting diode (LED) display, a liquid crystal display (LCD), a projector, or a cathode ray tube (CRT)). The machine 1200 may also include an alphanumeric input device 1212 (e.g., a keyboard), a cursor control device 1214 (e.g., a mouse, a touchpad, a trackball, a joystick, a motion sensor, or other pointing device), a memory unit 1216, a signal generating device 1218 (e.g., a speaker), and a network interface device 1220.

[0117] The storage unit 1216 includes a machine-readable medium 1222 (e.g., a tangible and / or non-transitory machine-readable storage medium) on which are stored instructions 1224 embodying any one or more of the methods or functions described herein. The instructions 1224 may reside, completely or at least partially, in the main memory 1204, in the processor 1202 (e.g., in a processor cache memory), or both during execution by the machine 1200. Thus, the main memory 1204 and the processor 1202 may be considered machine-readable media (e.g., a tangible and / or non-transitory machine-readable medium). The instructions 1224 may be transmitted or received over the network 1226 via the network interface device 1220. For example, the network interface device 1220 may communicate the instructions 1224 using any one or more transfer protocols (e.g., the Hypertext Transfer Protocol (HTTP)).

[0118] In some embodiments, the machine 1200 may be a portable computing device such as a smartphone or tablet computer and may have one or more additional input components (e.g., sensors or gauges). Examples of such additional input components include an image input component (e.g., one or more cameras), an audio input component (e.g., a microphone), a direction input component (e.g., a compass), a position input component (e.g., a Global Positioning System (GPS) receiver), a direction component (e.g., a gyroscope), a motion detection component (e.g., one or more accelerometers), an altitude detection component (e.g., an altimeter), and a gas detection component (e.g., a gas sensor). Input collected by any one or more of these input components may be accessible and usable by any of the modules described herein.

[0119] As used herein, the term "memory" may be interpreted to refer to a machine-readable medium capable of storing data, either temporarily or permanently, including, but not limited to, random access memory (RAM), read-only memory (ROM), buffer memory, flash memory, and cache memory. Although machine-readable medium 1222 is shown to be a single medium in one embodiment, the term "machine-readable medium" should be interpreted to include a single medium or multiple media capable of storing instructions (e.g., a centralized or distributed database, or associated caches and servers). The term "machine-readable medium" should also be interpreted to include any medium, or combination of multiple media, capable of storing instructions for execution by a machine (e.g., machine 1200), whereby the instructions, when executed by one or more processors (e.g., processor 1202) of the machine, cause the machine to perform any one or more of the methods discussed herein. Thus, "machine-readable medium" refers to a single storage device or storage device, as well as a "cloud-based" storage system or storage network including multiple storage devices or storage devices. The term "machine-readable medium" should accordingly be taken to include, but is not limited to, one or more tangible (e.g., non-transitory) data repositories in the form of solid-state memory, optical media, magnetic media, or any suitable combination thereof.

[0120] Additionally, machine-readable media is non-transitory in that it does not embody a propagated signal. However, categorizing tangible machine-readable media as "non-transitory" should not be construed to mean that the media is non-transferable; the media should be considered capable of being moved from one physical location to another. Additionally, because machine-readable media is tangible, the media may be considered to be a machine-readable device.

[0121] The instructions 1224 may further be transmitted or received over a network 1226 (e.g., a communications network) using a transmission medium via the network interface device 1220 and using any one of several known transfer protocols (e.g., HTTP). Examples of communications networks include a local area network (LAN), a wide area network (WAN), the Internet, a cellular network, a POTS network, and wireless data networks (e.g., WiFi and WiMAX networks). The term "transmission medium" should be interpreted to include any intangible medium capable of storing, encoding, or carrying instructions for execution by a machine, and to include digital or analog communications signals or other intangible media for facilitating communication of such software.

[0122] As noted above, any gas distribution box or gas panel can be controlled via the single EtherCAT interface described above. The single EtherCAT interface greatly simplifies the setup and testing of the gas distribution box or gas panel. In various embodiments, the gas distribution box can be configured and tested via a single EtherCAT connection, thereby eliminating the need for test equipment and problematic cabling as well as the separate interface box or boxes of the prior art. Thus, the disclosed subject matter can be easily integrated into any gas distribution box as typically coupled to a semiconductor processing tool, and can be pre-configured and tested such that the disclosed subject matter includes a plug-and-play configuration that allows for easy integration at an end user's site.

[0123] Throughout this specification, components, operations, or structures described as a single instance may be implemented in multiple instances. Although individual operations of one or more methods are illustrated and described as separate operations, one or more of the individual operations may be performed simultaneously, and the operations need not be performed in the order illustrated. Structures and functionality shown as separate components in example configurations may be implemented as combined structures or components. Similarly, structures and functionality shown as a single component may be implemented as separate components. These and other variations, modifications, additions, and improvements are within the scope of the subject matter of this specification.

[0124] Certain embodiments are described herein as including logic or a number of components, modules, or mechanisms. A module may constitute either a software module (e.g., code embodied in a machine-readable medium or a transmission signal) or a hardware module. A "hardware module" is a tangible unit capable of performing certain operations and may be configured or arranged in a particular physical manner. In various embodiments, one or more computer systems (e.g., a stand-alone computer system, a client computer system, or a server computer system) or one or more hardware modules of a computer system (e.g., a processor or a group of processors) may be configured as a hardware module that operates by software (e.g., an application or application portion) to perform certain operations described herein.

[0125] In some embodiments, a hardware module may be implemented mechanically, electronically, or any suitable combination thereof. For example, a hardware module may include dedicated circuitry or logic that is permanently configured to perform a particular operation. For example, a hardware module may be a special purpose processor, such as a field programmable gate array (FPGA) or an ASIC. Various embodiments described herein may use FPGAs that are pre-certified to SIL3 standards.

[0126] A hardware module may also include programmable logic or circuitry that is temporarily configured by software to perform certain operations. For example, a hardware module may include software embodied in a general-purpose processor or other programmable processor. It will be appreciated that the decision to mechanically implement a hardware module in dedicated permanently configured circuitry or in temporarily configured (e.g., software-configured) circuitry may be made based on cost and time considerations.

[0127] Thus, the phrase "hardware module" should be understood to encompass a tangible entity, an entity that is physically constructed, permanently configured (e.g., wired), or temporarily configured (e.g., programmed) to operate in a particular manner or perform particular operations as described herein. As used herein, a "hardware-implemented module" refers to a hardware module. When considering embodiments in which the hardware modules are temporarily configured (e.g., programmed), each hardware module need not be configured or instantiated at any one time. For example, if a hardware module includes a general-purpose processor that is configured by software to be a special-purpose processor, the general-purpose processor may be configured at different times as different special-purpose processors (e.g., including different hardware modules). Thus, the software may, for example, configure the processor to configure a particular hardware module at one time and a different hardware module at another time.

[0128] A hardware module can provide information to and receive information from other hardware modules. Thus, the described hardware modules may be considered to be communicatively coupled. When multiple hardware modules are present simultaneously, communication may be achieved by signal transmission (e.g., via appropriate circuits and buses) between two or more hardware modules. In embodiments in which multiple hardware modules are configured or instantiated at different times, communication between such hardware modules may be achieved, for example, by storing and retrieving information in a memory structure accessed by the multiple hardware modules. For example, one hardware module may perform an operation and store the output of the operation in a memory device to which the hardware module is communicatively coupled. Another hardware module may then later access the memory device to retrieve and process the stored output. A hardware module may initiate communication with an input device or an output device and can operate on a resource (e.g., a collection of information).

[0129] Various operations of the example methods described herein may be performed, at least in part, by one or more processors that are temporarily (e.g., by software) or permanently configured to perform the associated operations. Whether temporarily or permanently configured, such processors may constitute processor-implemented modules that operate to perform one or more operations or functions described herein. As used herein, a "processor-implemented module" refers to a hardware module implemented using one or more processors.

[0130] Similarly, the methods described herein may be at least partially processor-implemented, with a processor being an example of hardware. For example, at least some of the operations of a method may be implemented on one or more processors or processor-implemented modules. Furthermore, one or more processors may operate to support performance of related operations in a "cloud computing" environment or as a "software as a service" (SaaS). For example, at least some of the operations may be performed by a group of computers (as an example of an application that includes a processor), and these operations are accessible via a network (e.g., the Internet) and one or more suitable interfaces (e.g., application program interfaces (APIs)).

[0131] Performance of some operations may be distributed among one or more processors that are not solely located in a single machine but are spread across multiple machines. In some embodiments, one or more processors or processor-implemented modules may be in one geographic location (e.g., in a home environment, an office environment, or a server farm). In other embodiments, one or more processors or processor-implemented modules may be distributed across several geographic locations.

[0132] As used herein, the term "or" may be interpreted in an inclusive or exclusive sense. Moreover, other embodiments will be understood by those of ordinary skill in the art upon reading and comprehending the disclosure provided. Moreover, upon reading and comprehending the disclosure set forth herein, those of ordinary skill in the art will readily appreciate that all of the various combinations of the techniques and examples provided herein may be applied in various combinations.

[0133] Although the various embodiments are discussed separately, these separate embodiments are not intended to be considered as independent techniques or designs. As previously mentioned, each of the various parts may be interrelated and may be used separately from each other or in combination with the particulate matter sensor calibration system embodiments discussed herein. For example, although various embodiments of methods, operations, and processes have been described, these methods, operations, and processes may be used separately or in various combinations.

[0134] Thus, many modifications and variations may be made, which will be apparent to those skilled in the art upon reading and understanding the disclosure provided herein. In addition to those enumerated herein, functionally equivalent methods and apparatuses within the scope of the present disclosure will be apparent to those skilled in the art from the foregoing description. Portions and features of some embodiments may be included in or substituted for other embodiments. Such modifications and variations are intended to fall within the scope of the appended claims. Accordingly, the present disclosure shall be limited only by the terms of the appended claims, as well as the full scope of equivalents to which such claims are entitled. It is also to be understood that the terminology used herein is for the purpose of describing particular embodiments only, and is not intended to be limiting.

[0135] The Abstract of the present disclosure is provided to allow the reader to quickly ascertain the nature of the technical disclosure. The Abstract is submitted with the understanding that it will not be used to interpret or limit the claims. It will also be appreciated that in the foregoing Detailed Description, various features may be grouped together in a single embodiment for the purpose of streamlining the disclosure. This method of disclosure should not be construed as limiting the claims. As such, the following claims are hereby incorporated into the Detailed Description, with each claim standing on its own as a separate embodiment. The present disclosure may be realized in the following forms. [Form 1] 1. A distributed interlock system comprising: A plurality of slave nodes, each slave node having an interface conversion card and an interlock (ITLK) slave device; at least one master device in electrical communication with the plurality of slave nodes and configured to provide command and operation signals to selected ones of the plurality of slave nodes, the at least one master device further configured to evaluate signals received from the selected ones of the plurality of slave nodes in substantially real time, the at least one master device having at least one preventive interlock portion configured to evaluate an interlock condition and prevent an unsafe condition prior to one or more command executions related to the unsafe condition being sent to one or more of the plurality of slave nodes; A distributed interlocking system. [Form 2] A distributed interlock system as described in form 1, wherein at least one of the master devices is configured as a dual redundant device, and components of the at least one master device are configured to perform the same tasks such that if a first redundant module fails, a second redundant module automatically takes over the tasks of the first redundant module. [Form 3] 2. The distributed interlock system according to claim 1, wherein the plurality of slave nodes are configured to simultaneously sample an input signal received from a tool and transmit the sampled signal to the at least one master device; the plurality of slave nodes are further configured to simultaneously drive output signals after receiving a result from the at least one master device, the received result being based on the input signal sent to the at least one master device. [Form 4] 2. The distributed interlock system of claim 1, further comprising a sequencer for analyzing a sequence of events based on one or more signals received from at least one of the plurality of slave nodes after receiving the one or more signals from a tool. [Form 5] 2. The distributed interlock system of claim 1, further comprising an interlock equation solver for evaluating an interlock equation substantially in real time, the interlock equation being based on values ​​stored in a lookup table. [Form 6] 2. The distributed interlock system of claim 1, wherein an interlock latency based on the evaluated interlock condition is less than 1 millisecond and is independent of some interlock equations. [Form 7] 2. A distributed interlock system as described in claim 1, wherein all interlock calculations are centralized in the at least one master device. [Form 8] 2. A distributed interlock system as described in claim 1, wherein at least a portion of the plurality of slave nodes of the distributed interlock system are coupled to components within a gas supply box. [Form 9] 9. The distributed interlock system of claim 8, further comprising an integrated controller in the gas supply box that communicates with the distributed interlock system via an EtherCAT interface. [Form 10] 10. The distributed interlock system of claim 9, wherein each of the components in the gas supply box is configured to be inspected by the EtherCAT interface. [Form 11] 10. The distributed interlock system of claim 9, wherein the integrated controller of the gas supply box is one of the plurality of slave nodes for the at least one master device. [Form 12] 12. The distributed interlock system of claim 11, wherein the integrated controller is in communication with the at least one master for operating the gas supply boxes. [Form 13] 2. A distributed interlock system as described in claim 1, wherein the interlock (ITLK) slave device in each of the plurality of slave nodes communicates with components within one or more tools via an RS-485 interface. [Form 14] 1. A distributed interlock system comprising: A plurality of slave nodes, each slave node having an interface conversion card and an interlock (ITLK) slave device; a lookup table configured for at least one master device to determine whether any combination of consecutive events is detrimental to human safety and / or machine safety and operation, either for a single tool or between tools; the at least one master device configured to receive input signals from one or more of the plurality of slave nodes and provide output signals to one or more of the plurality of slave nodes, the at least one master device having at least one preventive interlock portion configured to evaluate an interlock condition and prevent the unsafe condition based on the look-up table before one or more command executions related to the unsafe condition are sent to one or more of the plurality of slave nodes; A distributed interlocking system. [Form 15] 15. The distributed interlock system of claim 14, further comprising: a non-volatile memory device coupled to each of the master devices for storing a total interlock equation; and a firmware device coupled to each of said master devices for performing operations; The distributed interlock system further comprises: [Form 16] 15. The distributed interlock system of claim 14, further comprising an interlock equation solver centralized within the at least one master device. [Form 17] 15. A distributed interlock system as described in claim 14, wherein at least a portion of the plurality of slave nodes of the distributed interlock system are coupled to components within a gas supply box. [Form 18] 1. A dual redundant distributed interlock system, comprising: A plurality of interlock slave devices; at least one master device in electrical communication with the plurality of interlock slave devices and configured to provide command and operation signals to selected interlock slave devices of the plurality of interlock slave devices, the at least one master device further configured to evaluate signals received from the selected interlock slave devices of the plurality of interlock slave devices in substantially real time, the at least one master device having at least one preventive interlock portion configured to prevent an unsafe condition prior to one or more command executions related to the unsafe condition being sent to one or more of the plurality of interlock slave devices; A dual redundant distributed interlock system including: [Form 19] 19. A dual redundant distributed interlock system as described in claim 18, wherein components of the dual redundant distributed interlock system are configured to perform the same tasks such that if a first redundant module fails, a second redundant module automatically takes over the tasks of the first redundant module. [Form 20] 19. A dual redundant distributed interlock system as described in claim 18, wherein a first redundant module drives an output signal and an output device, and a second redundant module reads the output signals, compares the output signals with its own results, and shuts off the output signals if there is a mismatch between at least one of the output signals and a corresponding result of its own within a predetermined limit.

Claims

1. 1. A distributed interlock system comprising: a plurality of slave nodes, each slave node having an interface conversion card and an interlock (ITLK) slave device; at least one master device in electronic communication with said plurality of slave nodes and programmable to prevent a combination of consecutive events harmful to human safety, said at least one master device configured to evaluate signals received substantially in real time from at least selected slave nodes of said plurality of slave nodes, said at least one master device having at least one preventive interlock portion configured to evaluate an interlock condition and to prevent said combination of consecutive events harmful to human safety prior to one or more command executions being sent to one or more of said plurality of slave nodes; A distributed interlocking system, including:

2. A distributed interlock system as described in claim 1, wherein the combination of successive events harmful to human safety is based on a look-up table readable by the at least one master device.

3. A distributed interlock system as described in claim 1, wherein the at least one master device is further configured to provide command and operation signals to at least the selected slave node of the plurality of slave nodes.

4. 2. The distributed interlock system of claim 1, wherein at least one of the master devices is configured as a dual redundant device, and components of the at least one master device are configured to perform the same tasks such that if a first redundant module fails, a second redundant module automatically takes over the tasks of the first redundant module.

5. 2. The distributed interlock system of claim 1, wherein the plurality of slave nodes are configured to simultaneously sample input signals received from a tool and transmit the sampled signals to the at least one master device; the plurality of slave nodes are further configured to simultaneously drive output signals after receiving a result from the at least one master device, the received result being based on the input signal sent to the at least one master device.

6. 2. The distributed interlock system of claim 1, further comprising a sequencer for analyzing a sequence of events based on one or more signals received from at least one of the plurality of slave nodes after receiving the one or more signals from a tool.

7. 10. The distributed interlock system of claim 1, further comprising an interlock equation solver for evaluating interlock equations substantially in real time, the interlock equations being based on values ​​stored in a lookup table.

8. 2. The distributed interlock system of claim 1, wherein an interlock latency based on the evaluated interlock condition is less than 1 millisecond and is independent of some interlock equations.

9. 2. The distributed interlock system of claim 1, wherein all interlock calculations are centralized in the at least one master device.

10. 2. The distributed interlock system of claim 1, wherein at least a portion of the plurality of slave nodes of the distributed interlock system are coupled to components within a gas distribution box.

11. 11. The distributed interlock system of claim 10, wherein each of the components in the gas distribution box is configured to be inspected by a communication interface.

12. 11. The distributed interlock system of claim 10, wherein an integrated controller of a gas distribution box is one of the plurality of slave nodes in electrical communication with the at least one master device.

13. 13. The distributed interlock system of claim 12, wherein the integrated controller is in communication with the at least one master for operating the gas distribution boxes.

14. 1. A distributed interlock system comprising: a lookup table configured to determine whether any combination of consecutive events is detrimental to human safety in either a single tool operation or a tool-to-tool operation; a plurality of slave nodes, each slave node having an interface conversion card and an interlock (ITLK) slave device; at least one master device coupled to the lookup table and in electrical communication with the plurality of slave nodes, the at least one master device configured to evaluate signals received from at least select slave nodes of the plurality of slave nodes in substantially real time, the at least one master device having at least one preventive interlock portion configured to evaluate an interlock condition and prevent the combination of consecutive events harmful to human safety based on the lookup table prior to one or more command executions being sent to one or more of the plurality of slave nodes; A distributed interlocking system, including:

15. A distributed interlock system as described in claim 14, wherein the at least one master device is further configured to provide command and operation signals to the at least selected slave nodes of the plurality of slave nodes.

16. 15. The distributed interlock system of claim 14, further comprising: a non-volatile memory device coupled to each of said master devices for storing a total interlock equation; a firmware device coupled to each of said master devices for performing operations; The distributed interlock system further comprises:

17. 15. The distributed interlock system of claim 14, further comprising an interlock equation solver centralized within the at least one master device.

18. 1. A dual redundant distributed interlock system, comprising: A plurality of interlock slave devices; at least one master device in electronic communication with the plurality of interlock slave devices and programmable to prevent any combination of sequences of events harmful to human safety, the at least one master device configured to evaluate signals received from selected interlock slave devices of the plurality of interlock slave devices in substantially real time, the at least one master device having at least one preventive interlock portion configured to prevent the unsafe condition before one or more command executions related to the unsafe condition are sent to one or more of the plurality of interlock slave devices; A dual redundant distributed interlock system including:

19. A dual redundant distributed interlock system as described in claim 18, further comprising a lookup table readable by the at least one master device, the lookup table being at least partially configured to enable the at least one master device to determine whether any combination of consecutive events is harmful to human safety.

20. 20. The dual redundant distributed interlock system of claim 18, wherein components of the dual redundant distributed interlock system are configured to perform the same tasks such that if a first redundant module fails, a second redundant module automatically takes over the tasks of the first redundant module.

21. 20. The dual redundant distributed interlock system of claim 18, wherein a first redundant module drives output signals and output devices, and a second redundant module reads output signals, compares said output signals with its own results, and shuts off said output signals if there is a mismatch between at least one of said output signals and a corresponding one of its own results within a predetermined limit.

Images