Page review information
Edition covered
Semiconductor facility engineering practice — SEMI facility standards, fire/building codes context — n/a — facility-engineering reference; site codes and the AHJ govern editions
Content status
Reviewed
Coverage
Facility safety interlock and ESD layering reference with cause-and-effect patterns; illustrative, site safety design governs.
Last reviewed
August 2026
Primary reference
The official published standard — required for final decisions

Confirm the governing edition, jurisdiction, and project-specific requirements before applying anything on this page.

Semiconductor Facility — Safety Architecture

Safety and Shutdown Architecture

This page maps the shutdown layers that appear across semiconductor facility utility systems — how they are structured, what inputs they respond to, what actions they take, and what documentation must exist before commissioning.

Shutdown Layer Model

Semiconductor facility shutdowns follow a layered architecture. Each layer has different scope, ownership, and reset authority.

flowchart TD
    L1["Layer 1 — Equipment Self-Protection\nProtects the skid, pump, valve train\nExamples: dry-run stop, high motor current, fail-to-open timeout"]
    L2["Layer 2 — Utility or Sequence Interlock\nPrevents unsafe or invalid operating combinations\nExamples: exhaust required, source unavailable, destination not ready"]
    L3["Layer 3 — Local Hazardous Shutdown\nIsolates cabinet, skid, or enclosure\nOwned by local logic + hardwired paths\nExamples: leak detection, gas detection, severe process deviation"]
    L4["Layer 4 — Area or Facility Emergency Response\nCrosses package boundaries\nExamples: fire alarm, EPO, area gas alarm escalation, ESD bus"]

    L1 --> L2 --> L3 --> L4

    style L1 fill:#e3f2fd,stroke:#2196f3
    style L2 fill:#fff8e1,stroke:#ff9800
    style L3 fill:#fce4ec,stroke:#f06292
    style L4 fill:#f3e5f5,stroke:#ab47bc

A lower layer must never override a higher layer. Layer 4 inputs always take priority regardless of local mode or operating state.

Layer Definitions

Layer 1 — Equipment Self-Protection

Layer 2 — Utility or Sequence Interlock

Layer 3 — Local Hazardous Shutdown

Layer 4 — Area or Facility Emergency Response

Core Design Rules

Rule Why it matters
Define safe state for each hazard scenario, not just each piece of equipment Safe state is scenario-dependent — a pump stop is not always the safe action for a chemical leak
Same input may alarm locally but trip only under a voting, persistence, or zone rule Single-sensor trips create nuisance shutdowns; voting logic with persistence prevents false trips without masking real events
Hardwired shutdown paths must be documented separately from SCADA alarms Network-based alarms are advisory until proven reliable in all failure modes
Manual reset rules matter as much as trip rules Automatic reset after hazard clearance re-enables a hazard before the cause is understood

Inputs That Commonly Participate in Shutdown Logic

Input Typical layer involvement
Hazardous gas detection Layer 3 (local zone), Layer 4 (area escalation)
Chemical leak detection Layer 3 (local system), Layer 4 (facility ESD if escalated)
Fire alarm Layer 4 — always
Emergency power off (EPO) Layer 4 — always
Exhaust loss Layer 2 (block enable), Layer 3 (active shutdown if system running)
Overpressure Layer 1 or Layer 3 depending on whether a pressure safety valve exists
Vacuum loss (where capture depends on it) Layer 2 or Layer 3 depending on hazard
Abnormal temperature (where chemistry or materials are at risk) Layer 1 or Layer 3 depending on consequence

Common Output Actions

Action Typical trigger layer
Isolate gas or chemical supply (close valves) Layer 3, Layer 4
Stop pump or heater Layer 1, Layer 3
Maintain or force exhaust Layer 3 — exhaust loss is a shutdown input, not an output to disable
Enable purge sequence Layer 3 after gas isolation
Remove permit-to-run from tool Layer 2, Layer 3
Generate local alarm All layers
Generate supervisory alarm Layer 2 and above
Notify area emergency response Layer 4

Instrument Design for Safety Functions

When a detection input participates in Layer 3 or Layer 4 shutdown, the instrument must meet additional requirements:

Documents That Must Exist Before Commissioning

Document Contents
Shutdown hierarchy Which layers exist, what each owns, who resets each layer
Cause and effect matrix Every initiating cause → every resulting action, by system
Reset authority table Who can reset each layer, what conditions must be met first
Proof-test and maintenance plan Frequency, method, and responsible party for critical detectors and shutdown devices

Standards Anchors

Standard Role
IEC 61511 Process safety lifecycle — applies when the shutdown function is a Safety Instrumented Function (SIF) requiring formal SIL design
IEC 61508 Generic functional safety — underpins IEC 61511; applies when device SIL capability must be demonstrated
SEMI S2 / S14 Equipment safety framing — shutdown logic at the tool boundary
SEMI S6 Exhaust ventilation — exhaust loss as a shutdown trigger
NFPA 318 / NFPA 72 Fire alarm integration with facility shutdown
NFPA 55 Gas storage and emergency response context
ISA-18.2 Alarm management — prevents alarm system saturation that masks safety-critical signals

See Also

Trust Boundary — Engineering Judgment Required

This site is an independent educational reference for industrial automation standards. It paraphrases and organizes guidance in original language; it is not a substitute for the official published standards, professional engineering judgment, or legal review, and content has not been independently verified against current published editions.

Items marked Review pending await technical review against the identified edition. Items marked Planned have no reviewed source material behind them. Do not rely on this site for compliance determinations, safety-critical design decisions, or legal interpretation.