Emergency Off (EMO) vs Emergency Stop

The concept of Emergency Off (EMO) used by the semiconductor manufacturing sector is similar in many ways to the emergency stop used in all other types of machinery, with some differences. This article covers the differences between these concepts.

NOTE: This is a long post!

TL;DR: EMO and emergency stop are very similar, however, there are some differences that need to be understood, including the marking of the EMO device used to activate the circuit/function.

Introduction

The differences between EMO and emergency stop are both subtle and not-so-subtle. On the subtle side, the energy limits placed on EMO circuits are not addressed at all in the ISO standards. On the not-so-subtle side, the markings and shrouding for EMO are quite different from an emergency stop in all but one way: red-and-yellow are still the dominant colours.

One further subtlety: ISO 13850 and IEC 60204-33 are International Standards that are developed under an internationally recognized, transparent, consensus process. The SEMI Guidelines are neither standards nor does SEMI follow an internationally recognized, transparent, consensus process, although to be fair, they do have their own methodology.

Want to know more? Read on!

Standards and Guidelines

These standards and guidelines are discussed in this article:

  • SEMI S2 Environmental, Health, and Safety Guideline for Semiconductor Manufacturing Equipment
  • IEC 60204-1 Safety of machinery — Electrical equipment of machines — Part 1: General requirements
  • IEC 60204-33 Safety of machinery – Electrical equipment of machines – Part 33: Requirements for semiconductor fabrication equipment
  • ISO 12100 Safety of machinery — General principles for design — Risk assessment and risk reduction
  • ISO 13850 Safety of machinery – Emergency stop – Principles for design

Standards vs Guidelines

Since this article references both standards and guidelines, it’s important to understand the differences between these types of documents. If you’ve been reading Machinery Safety 101 for a while, you’ll know that I strongly support the use of standards in design.

Voluntary standards, like those published by ANSI, CSA, IEC and ISO, are developed following a rigorous consensus process. This process is designed to include stakeholders in the development process and includes National and public review of the documents developed through this process. You can read more about this process by visiting the ISO website. If you are interested in finding out about your National Standards Body, you can find a list on the ISO Members page. ISO Members are national standards bodies, not individual people.

A standard, according to the ISO definition, is a: “ Document established by consensus and approved by a recognized body that provides for common and repeated use, rules, guidelines or characteristics for activities or their results aimed at achieving the optimum degree of order in a given context.”

[6]

National standards development organizations are accredited by the National Standards Body in countries that are members of the World Trade Organization (WTO). ANSI is the American standards body, accredited by the US National Institute of Standards and Technology (NIST). The Canadian Standards Association (CSA) is accredited by the Standards Council of Canada (SCC). SCC is Canada’s National Standards Body.

Consensus standards include specific words, called verbal forms, that indicate requirements, recommendations, permissions, possibilities and capabilities [10]. These terms are used very deliberately [11]:

  • “shall” is used to express a requirement, i.e., a provision that the user is obliged to satisfy in order to comply with the Standard;
  • “should” is used to express a recommendation or that which is advised but not required; and
  • “may” is used to express an option or that which is permissible within the limits of the Standard.
  • Notes accompanying clauses do not include requirements or alternative requirements; the purpose of a note accompanying a clause is to separate from the text explanatory or informative material.
  • Notes to tables and figures are considered part of the table or figure and may be written as requirements.
  • Annexes are designated normative (mandatory) or informative (non-mandatory) to define their application.

This same usage is common to voluntary consensus standards developed under the WTO model.

SEMI, formerly Semiconductor Equipment and Materials International, is a global industry association for the electronics industry. SEMI produces guidelines for use in the industry sector. These documents can be considered “consortium standards” because they are written by an industry consortium.

Consortia standards is also a frequently used term, describing standards developed and used by a plurality of actors, but for which the level of consensus is usually restricted to the members of a consortium (not necessarily representing the views of all the concerned and affected parties)..

[8]

Experts working on the development of these standards and guidelines are drawn from the members of the consortium, and there is no public review process. From the SEMI website [7],

Standards are voluntary technical agreements between suppliers and customers, aimed at improving product quality and reliability at a reasonable price and steady supply. Standards ensure compatibility and inter-operability of goods and services.

SEMI standards are written documents in the form of specifications, guides, test methods, terminology, practices, etc.

[6], [9]

SEMI includes a statement of limitation on their guidelines that limit any authority,

3.1 This guideline is intended for use by supplier and user as a reference for EHS considerations. It is not intended to be used to verify compliance with local regulatory requirements.

3.2 It is not the philosophy of this guideline to provide all of the detailed EHS design criteria that may be applied to semiconductor manufacturing equipment. This guideline provides industry-specific criteria, and refers to some of the many international codes, regulations, standards, and specifications that should be considered when designing semiconductor manufacturing equipment.

[1]

The term “shall” is not used in SEMI Guidelines based on the Statement of Limitation, which means that SEMI Guidelines do not include any requirements. This is fundamentally different from voluntary consensus standards. SEMI Guidelines do not follow the same standardized terminology used in consensus standards developed under the WTO model. This might seem like pure semantics, or perhaps pedantry, but it has real-world implications; SEMI Guidelines cannot be used for regulatory compliance, like CE Marking. Also, since these documents do not go through consensus review, individual stakeholders can have an outsized influence on the content. This can result in the exclusion of competitors or the exclusion of new technologies from the marketplace.

SEMI S2 EMO Requirements

Chapter 12 of SEMI S2 [1], Emergency Shutdown, provides the requirements for EMO in detail. Since that section is quite long I am only going to reproduce the sections where there are significant differences from the emergency stop function as defined by ISO 13850 [2]. Also note that the version I am using as a reference is a few years old (2012), and so the most recent edition of that document may have changes that have not been reflected in this article.

One other important detail: At no point does SEMI S2 define the terms “emergency off”, “emergency off circuit” or “emergency off function.” It seems that these terms are expected to be sufficiently explained in Chapter 12, so no separate definitions are required. Personally, I think this is a significant shortcoming in SEMI S2.

Requirement for an EMO circuit

ISO 12100 [3, 6.3.5.2] states that “If, following a risk assessment, a machine needs to be fitted with components and elements to achieve an emergency stop function for enabling actual or impending emergency situations to be averted, the following requirements apply…” There are actually two primary cases where an emergency stop function is needed: If a type C standard requires it, and in the general case when the risk assessment shows a need to provide this capability. Outside of this, there is one other mandatory case, and that is when local legislation mandates it.

It’s also important to note that ISO 12100 refers to “…components and elements to achieve an emergency stop function…” The use of the word “function” in the normative text points to the idea that an emergency stop function may require more than electrical circuitry to be realized. Pneumatic equipment, electromechanical brakes, and other components or subsystems may be needed depending on the type of machinery and the specifics of its design.

If we contrast this with what is required by [1], we find a similar idea, expressed in some slightly different language:

12.1 The equipment should have an “emergency off” (EMO) circuit.

[1, 12.1]

At this point, [1] does not give any specific guidance on what would determine the requirement, and no mention is made of risk assessment. There are two exceptions given in the text. I’ll quote them here, and then analyze them in turn:

EXCEPTION 1: An EMO circuit is not needed for equipment rated 2.4 kVA or less, where the hazards are only electrical in nature, provided that the main disconnect meets the accessibility provisions of §12.5.2 and that the effect of disconnecting the main power supply is equivalent to activating an EMO circuit.

[1, 12.1]

EXCEPTION 2: Assemblies that are not intended to be used as stand-alone equipment, but rather within an overall integrated system, and that receive their power from the user’s system, are not required to have an emergency off circuit. The assembly’s installation manual should provide clear instructions to the equipment installer to connect the assembly to the integrated system’s emergency off circuit.

[1, 12.1]

SEMI S2 is focused on circuits, to the exclusion of all other means of creating the emergency off function. In fact, the word “function” is not used at all. It is not clear from the SEMI text whether EMO could be created using fluidic circuits or not, as this point is not directly addressed, however, it can be inferred electrical circuits were the focus of the writers by examining the rest of chapter 12. Since S2 is focused on electrical circuits, we will need to consider the requirements of IEC 60204-1 [4]. I should note here the IEC 60204 series includes IEC 60204-33 [5] for semiconductor equipment which builds upon the requirements in IEC 60204-1, and is clearly written to harmonize with SEMI S2. If CE Marking is your focus, [5] has been harmonized as EN 60204-33 [11].

S2 goes on to say,

The EMO actuator (e.g., button), when activated, should place the equipment into a safe shutdown condition, without generating any additional hazard to personnel or the facility.

[1, 12.1]

I think the language in S2 actually misses an important point; while the EMO actuator might be a purely electromechanical device installed so that it can switch off the power, in most cases, there will actually be some circuitry attached to the actuator that actually does the switching off. It is this circuitry that is responsible for creating the shutdown condition. The S2 language could imply that the actuator itself does the switching off, which I think is incorrect based on the rest of the chapter.

On to the exceptions to these requirements. In the first exception, small, relatively low-power electrical equipment where only electrical hazards exist are allowed to use the main disconnect for EMO.

EXCEPTION 1: An EMO circuit is not needed for equipment rated 2.4 kVA or less, where the hazards are only electrical in nature, provided that the main disconnect meets the accessibility provisions of §12.5.2 and that the effect of disconnecting the main power supply is equivalent to activating an EMO circuit.

[1, 12.1]

This is equivalent to the “Emergency Switching Off” concept discussed in IEC 60204-1 [4, 10.8]. The emergency switching off device is defined in [4] as follows:

emergency switching off device
manually actuated control device used to switch off or to initiate the switching off of the supply of electrical energy to all or a part of an installation where a risk of electric shock or another risk of electrical origin is involved

Note 1 to entry: See 9.2.3.4.3.

[4, 3.1.22]

Since [4, 10.8] allows for the use of a disconnecting device for emergency switching off, we can consider the S2 and IEC 60204-1 requirements equivalent.

The second exception is focused on assemblies that aren’t intended to be stand-alone equipment. These assemblies have to be integrated into other equipment to be useful, and so will also draw their power from other equipment fitted with an EMO circuit. This special circumstance is not considered by [3], since that document relies on risk assessment to determine the need for an emergency stop or switching off function, while S2 does not consider risk assessment.

EXCEPTION 2: Assemblies that are not intended to be used as stand-alone equipment, but rather within an overall integrated system, and that receive their power from the user’s system, are not required to have an emergency off circuit. The assembly’s installation manual should provide clear instructions to the equipment installer to connect the assembly to the integrated system’s emergency off circuit.

[1, 12.1]

[1, Note 42] brings some confusion to the topic, since it refers to emergency off functions, while the initial paragraph and exceptions are focused on circuits.

NOTE 42: It is recommended that the emergency off function not reduce the effectiveness of safety devices or of devices with safety-related functions (e.g., magnetic chucks or braking devices) necessary to bring the equipment to a safe shutdown condition effectively.

[1, Note 42]

Additionally, Note 42 does not require that other safety devices or functions not be impacted by the operation of the EMO circuits/function, which is also a significant error, since the reason an operator may be activating the EMO may be because a gas leak has been detected, or a fire is in progress. If operating the EMO impairs or disables other safety devices/functions, this could lead to catastrophe. By the way, before anyone posts angry comments, [1, 14.4.4.7] requires that fire detection systems remain operable even during EMO conditions. My point is simply that there are some apparent inconsistencies that readers need to be aware of when using SEMI S2.

Effects of EMO Activation

When the EMO function/circuit is activated, specific actions are required.

12.2 Activation of the emergency off circuit should de-energize all hazardous voltage and all power greater than 240 volt-amps in the equipment beyond the main power enclosure.

[1, 12.2]

SEMI S2 does not explain the 240 VA lower limit, however, since there are three typical voltages commonly used for control systems, 230 V 1 ph., 120 V 1 ph., and 24 Vdc, we can do the math to see the kinds of current levels NOT affected by this requirement.

\frac{240~\text{VA}}{230~\text{V}}=1.04~\text{A}
\frac{240~\text{VA}}{120~\text{V}}=2~\text{A}
\frac{240~\text{VA}}{24~\text{V}}=10~\text{A}

All of the above are relatively low-energy circuits, although they do not fall into the voltage range for PELV, which requires special handling of the ground or earth connection. What the SEMI S2 committee is doing in this clause is providing the designer with an exemption for these low-energy circuits. Also notice that clause 12.2 stipulates that the requirement applies to “…equipment beyond the main power enclosure.” They are trying to ensure that equipment supplied by hazardous voltages is effectively shut off when the EMO button is pressed.

Exceptions

There are four exceptions provided in the document to the “240 VA rule”:

EXCEPTION 1: A non-hazardous voltage EMO circuit (typically 24 volts) and its supply may remain energized.

Exception 1 is not terribly surprising, and most equipment built with a 24 V control system will fall into this category. Keeping the EMO system functional is beneficial, at least as long as there is power available to other potentially hazardous parts of the equipment.

EXCEPTION 2: Safety related devices (e.g., smoke detectors, gas/water leak detectors, pressure measurement devices, etc.) may remain energized from a non-hazardous power source.

Exception 2 makes sense as well, since keeping life-safety systems functional under abnormal conditions is a good idea. In this case, any situation that causes the user to need to use the EMO system should be considered “abnormal.”

EXCEPTION 3: A computer system performing data/alarm logging and error recovery functions may remain energized, provided that the energized breaker(s), receptacle(s), and each energized conductor termination are clearly labeled as remaining energized after EMO activation. Hazardous energized parts that remain energized after EMO activation should be insulated or guarded to prevent inadvertent contact by personnel.

Exception 3 makes sense because keeping data collection systems functioning means that you may have clues as to the abnormal conditions that led to the use of the EMO system.

EXCEPTION 4: Multiple units mounted separately with no shared hazards and without interconnecting circuits with hazardous voltages, energy levels or other hazardous conditions may have:

• separate sources of power and separate supply circuit disconnect means if clearly identified, or

• separate EMO circuits, if they are clearly identified.

Exception 4 points to a key aspect of interface design for integration with other equipment. Usually, the best design approach is to provide potential-free contacts as the interface between safety systems, when this can be done. Alternatively, modern “safety” busses allow for reliable communication of information between safety systems, so the use of a networked safety protocol can solve some of the issues, including the need to have galvanic isolation between the control systems. The hardware layer in networking systems, like Ethernet, for example, have built-in galvanic separation using optocouplers, thus ensuring that any lack of equipotentiality between pieces of equipment that are integrated into a single application won’t cause a problem with noise.

Reliability

The reliability of emergency stop functions is important. ISO 13850 requires that emergency stop functions provide at least PL=c performance. This can be achieved with ISO 13849-1 structure category 1, 2 or 3, depending on how the designer wants to approach the function.

In contrast, SEMI S2 does not follow the ISO 13849 approach, instead providing the following guidance:

12.2.1 The EMO circuit should not include features that are intended to allow it to be defeated or bypassed.

IEC and ISO hold that interlocking functions and emergency stop functions should be kept separate in the control system. There are a number of reasons for this, but probably the two most important ones are:

  • Emergency stop systems are designed to bring equipment to a stop as quickly as possible, and then remove power from the prime-movers powering the hazardous motions. The speed with which the stop occurs can damage the machine, and so the use of the function under normal conditions should be avoided unless the machine is already stopped. Loss of position and ease of recovery are not generally considerations in the design of an e-stop safety function.
  • Safety functions like guard interlocks and light-curtain safety functions are designed for thousands of cycles. The stopping process they use is designed to bring the equipment to a stop quickly, but below the threshold of damage, and power may be maintained on the prime-movers. Ease of recovery is an important part of the design of these safety functions.
  • The Performance Level of an interlocking function and an emergency stop function need not be the same. There are reasons why one might be higher or lower than the other

This discussion is deep enough on its own to need a separate article.

12.2.2 The EMO circuit should consist of electromechanical components.

Clause 12.2.2 follows on a long-held position by many engineers that solid-state devices cannot be made reliable enough for safety systems, and therefore suitably selected electromechanical relays are the only thing reliable enough since solid-state devices have a tendency to fail into “indeterminate” states – not open and not shorted, but something in between. Developments in functional safety over the last 25 years have shown that this is not the case. Light curtains and other dual-channel devices are built with solid-state outputs so that they can tolerate the high-frequency operation required. When these devices are connected to safety modules or safety PLCs, they can and do provide more than reliable-enough operation. Having said that, in low-frequency applications, like emergency stop or EMO, an electromechanical relay is still often the best choice. If your equipment was originally designed under a standard other than SEMI-S2, you may need to replace some e-stop system components with electromechanical ones to meet this guideline or put together sufficient rationale to convince your customer of the benefits of your current design. Note that the Exceptions, below, give you that latitude. A carefully done functional safety analysis should provide the support needed.

EXCEPTION 1: Solid-state devices and components may be used, provided the system or relevant parts of the system are evaluated and found suitable for use. The components should be evaluated and found suitable considering abnormal conditions such as over voltage, under voltage, power supply interruption, transient overvoltage, ramp voltage, electromagnetic susceptibility, electrostatic discharge, thermal cycling, humidity, dust, vibration and jarring. The final removal of power should be accomplished by means of electromechanical components.

EXCEPTION 2: FECS may be used provided the FECS conforms to an appropriate standard for electronic safety systems. Components of the FECS should be tested and certified according to the requirements of the standard used. IEC 61508 and ISO 13849-1 are examples of internationally recognized electronic safety systems standards. The final removal of power should be accomplished by means of electromechanical components.

NOTE 44: ¶ 13.4.3 states additional assessment criteria for safety-related components and assemblies.

NOTE 45: A FECS is a subsystem of a PES. IEC 61508 is the preferred standard for complex PES.

Safety-related software is permitted by Exception 2 and Note 45, however, the bar is set quite high. The effort necessary to follow IEC 61508 will be prohibitive in many organizations, pushing smaller machine builders back to hardware-based EMO circuits.

12 Emergency Shutdown

If you’re still reading, you’re almost at the end. We just need to discuss the requirements of the Emergency Shutdown safety function.

12.2.3 All EMO circuits should be fault-tolerant.

If you’ve followed the requirements for reliability discussed previously, then fault tolerance may already be looked after, however, be aware that ISO 13850 makes the minimum PL for emergency stop PL=c. This performance level can be met with ISO 13849-1 Category 1 single-channel architecture which can be met with basic and well-tried safety principles and well-tried components, but no diagnostics or with Category 2 single-channel architecture which uses basic and well-tried safety principles with some degree of diagnostics. Neither Category 1 nor 2 is fault-tolerant. To get to fault tolerance, you need at least two channels to provide redundancy. That will require ISO 13849-1 Category 3 or 4 architecture, or IEC 62061, 1oo2 with HFT=1.

12.2.4 Resetting the EMO switch should not re-energize circuits, equipment, or subassemblies.

A separate manual reset is required. This is true under ISO 13850 as well, so this should not be a surprise. You may want to read my posts on the manual reset safety function, and manual reset via an HMI.

12.2.5 The EMO circuit should shut down the equipment by de-energizing rather than energizing control components.

This requirement exists in ISO 13849 as part of the well-tried safety principles. For more on that, see ISO 13849-2.

12.2.6 The EMO circuit should require manual resetting so that power cannot be restored automatically.

12.2.6 is tightly linked to 12.2.4, so I won’t add to that further.

12.3 The emergency off button should be red, mushroom shaped, and self latching. A yellow background for the EMO should be provided.

Guideline 12.3 is harmonized with the requirements in ISO 13850 and IEC 60204-1, both of which require a yellow background behind a red mushroom-head operator like that illustrated below.

Typical red emergency stop button with a yellow background.
Typical emergency stop button

12.4 All emergency off buttons should be clearly labeled as “EMO,” “Emergency Off,” or the equivalent and should be clearly legible from the viewing location. The label may appear on the button or on the yellow background.

Guideline 12.4 differs significantly from the international requirements. Outside of older equipment built in North America, marking the background with any text, whether it was “emergency stop,” “arrête d’urgence,” “not-aus” or something else, machinery standards have not required any text on the yellow background at all. Internationally, the use of text can be a significant problem since the machine users may not be able to read English. In any jurisdiction, it is quite possible to have users who are partially or completely illiterate. As a consequence, the use of the colour combination RED-and-YELLOW is now universally recognized to mean “emergency stop.” IEC 60617 offers the pictogram shown below that can be used:

IEC Symbol for emergency stop. Black and white figure showing a circle with an inverted equilateral triangle inside, with an exclamation point contained inside the triangle.
IEC 60417-5638 – Symbol for “emergency stop” ©IEC.

Here’s the problem:

  1. There is no pictogram for emergency off
  2. Emergency stop and EMO are not considered to be exactly equivalent
  3. IEC 60204-33 does not discuss emergency stop, although clause 9.2.1 NOTE 2 states “The EMO can fulfil the requirement to provide an emergency stop function.”

Based on all of these points, if you are building a machine that requires EMO, the SEMI S2 guidelines must be met, and the device must be marked “EMO” as shown in the first image in this post. You cannot use the e-stop symbol IEC 60417-5638.

12.5 Emergency off buttons should be readily accessible from operating and regularly scheduled maintenance locations and appropriately sized to enable activation by the heel of the palm.

This same requirement applies to emergency stop buttons as to EMO buttons.

12.5.1 Emergency off buttons should be located or guarded to minimize accidental activation.

?? ISO 13850 allows for “shrouds” to help prevent inadvertent actuation of the devices, but in many jurisdictions, the use of any kind of structure around the e-stop button is not permitted. Be careful about this one, since the presence of structures around buttons that are marked red-and-yellow represent “low-hanging fruit” for inspectors since the structures are easily visible.

12.5.2 No operation or regularly scheduled maintenance location should require more than 3 m (10 ft.) travel to an EMO button.

?? Best practices, and some regulations and standards, use the “within easy reach” rule for the location of e-stop devices. This rule recommends that emergency stop devices should be located “within easy reach” of the operator when they are at the defined operator station. Typically “within easy reach” is interpreted as with an arm’s length, or about 1 m / 3 ft. Outside of the operator stations, there is no requirement. SEMI S2, on the other hand, requires that emergency off devices should be located within 3 m /10 ft. of operation and maintenance locations. This is a very different requirement.

12.5.3 The person actuating or inspecting the EMO switch assembly should not be exposed to hazards with a SEMI S10 risk of Medium or greater. Examples of hazards that could have such risk are:

• contacting energized electrical parts,

• contacting moving machinery,

• contacting surfaces that are at excessively high or low temperatures, and

• limited or poor access causing impacts, tripping or falling during rapid movement during an emergency.

Guideline 12.5.3 can be very difficult to ensure, at least some parts of it. Preventing contact with live electrical parts when actuating the EMO should not be difficult. However, preventing contact with moving machinery may not be possible, nor may it be possible to prevent “limited or poor access causing impacts, tripping or falling during rapid movement during an emergency.” Great care is needed when designing for conformity with this guideline.

12.6 See § 13.5 for additional EMO guidelines when EMOs are used with UPSs.

I’m not going to explore the requirements for implementing EMO with a UPS integrated into the machinery. I’ll leave that up to you if you’re so inclined.


Definitions

The following definitions are excerpts from [1].

5.2.13 fail-safe
designed so that a failure does not result in an increased risk.
NOTE 2: For example, a fail-safe temperature limiting device would indicate an out-of-control temperature if it were to fail. This might interrupt a process, but would be preferable to the device indicating that the temperature is within the control limits, regardless of the actual temperature, in case of a failure.
5.2.14 fail-to-safe equipment control system (FECS)
a safety-related programmable system of control circuits designed and implemented for safety functions in accordance with recognized standards such as ISO 13849-1 (EN 954-1) or IEC 61508, ANSI SP 84. These systems (e.g., safety programmable logic controller (PLC), safety related input and output (I/O) modules) diagnose internal and external faults and react upon detected faults in a controlled manner in order to bring the equipment to a safe state.
NOTE 3: A FECS is a subsystem to a programmable electronic system (PES) as defined in IEC 61508-4 Definitions.
NOTE 4: Related Information 13 provides additional information on applications of FECS design.
5.2.15 failure
the termination of the ability of an item to perform a required function. Failure is an event, as distinguished from “fault,” which is a state.
5.2.16 fault
the state of an item characterized by inability to perform a required function, excluding the inability during preventive maintenance or other planned actions, or due to lack of external resources.
5.2.17 fault-tolerant
designed so that a reasonably foreseeable single point failure does not result in an unsafe condition.
5.2.28 hazardous voltage
unless otherwise defined by an appropriate international standard applicable to the equipment, voltages greater than 30 volts RMS, 42.4 volts peak, 60 volts dc are defined in this Document as hazardous voltage.
NOTE 5: The specified levels are based on normal conditions in a dry location.
5.2.58 positive-opening
as applied to electromechanical control devices. The achievement of contact separation as a direct result of a specified movement of the switch actuator through non-resilient members (i.e., contact separation is not dependent upon springs).
5.2.68 safe shutdown condition
a condition in which all hazardous energy sources are removed or suitably contained and hazardous production materials are removed or contained, unless this results in additional hazardous conditions.
5.2.69 safety critical part
discrete device or component, such as used in a power or safety circuit, whose proper operation is necessary to the safe performance of the system or circuit.

References

[1] Environmental, Health, and Safety Guideline for Semiconductor Manufacturing Equipment, SEMI S2, 2012.

[2] Safety of machinery – Emergency stop – Principles for design, ISO 13850. 2015

[3] Safety of machinery — General principles for design — Risk assessment and risk reduction, ISO 12100. International Organization for Standardization (ISO). 2010.

[4] Safety of machinery — Electrical equipment of machines — Part 1: General requirements, IEC 60204-1. International Electrotechnical Commission (IEC). 2016.

[5] Safety of machinery – Electrical equipment of machines – Part 33: Requirements for semiconductor fabrication equipment, IEC 60204-33. International Electrotechnical Commission (IEC). 2009.

[6] Standardization and related activities — General vocabulary, ISO/IEC Guide 2. 2004.

[7] “About SEMI Standards | SEMI”, Semi.org, 2020. [Online]. Available: https://www.semi.org/en/Standards/P_000787. [Accessed: 14- Jun- 2020].

[8] Teaching Standards — Good practices for collaboration between National Standards Bodies and universities, 1st ed. Geneva: International Organization for Standardization (ISO), 2014.

[9] PROCEDURE MANUAL DETAILING SEMI® STANDARDS PROCESSES AND PRACTICES. Milpitas, California: SEMI, 2020.

[11] Safeguarding of Machinery, CSA Z432, Canadian Standards Association (CSA). 2016.

[12] Safety of machinery – Electrical equipment of machines – Part 33: Requirements for semiconductor fabrication equipment, EN 60204-33. European Committee for Electrotechnical Standardization (CENELEC), Brussels. 2011.

2 thoughts on “Emergency Off (EMO) vs Emergency Stop

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.