Patent Application
20050108577
The present invention relates to a remote diagnostic system and diagnostic method for facilities and particularly a remote diagnostic system and diagnostic method which is suitable for use when the manufacturer of at least a part of the facilities and the user of said facilities are different as in a semiconductor manufacturing line. Here the term “facilities” is not limited only to the production facilities such as a semiconductor manufacturing line; it also refers to the equipment and facilities composed of a combination of various systems and components, including non-production facilities such as large sized financial systems.
In recent years, systems having a remote diagnosis function using the Internet have been proposed. One of such remote diagnosis functions is disclosed in the Official Gazette of Japanese Patent Laid-Open NO. 40200/1998 where various data preset at the terminal station are sent to a remote diagnostic system installed at the center office of a service company. Remote diagnosis is started at the center office based on the data sent from the terminal station, and a new data obtained by correction of terminal equipment setting errors is sent back to the user. The system disclosed in the Official Gazette of Japanese Patent Laid-Open NO. 40200/1998 provides a operation technique of initialization, error diagnosis and data updating of the equipment connected to the terminal on the computer network or the equipment incorporating said terminal, where the equipment connected to the Internet or the equipment incorporating the terminal thereof are diagnosed for error. The equipment sends status data to the terminal, and the terminal transfers the received status data to the server on the Internet. Based on the received status data, the server diagnoses the equipment and sends the result of diagnosis to said terminal.
In such a remote diagnostic system, the user need not disclose information on equipment diagnosis which may require protecting security thereof in some cases, for example, in home electronic appliances, on the one hand. On the other hand, data related on user security may leak if three is no protection against external access for system diagnosis as in the case of the manufacturing system.
In an effort to provide a remote diagnostic system for communications equipment ensuring effective protection of the remote diagnosis, Official Gazette of Japanese Patent Laid-Open NO. 149188/1997 discloses a system comprising (1) a data creating means to create data in the center station equipment of the remote diagnostic system based on the ID number preset on the terminal equipment and to send the created data to the terminal station equipment, (2) an ID number setup means to set ID numbers on the terminal station equipment and to send the preset ID numbers to said center station equipment, (3) a data analysis means to analyze the received data and (4) a diagnostic control means to evaluate whether remote diagnosis is possible or not.
Another known system is the one where equipment for access to the LAN line is installed, and an ID (Internet Protocol) address is assigned to each system, thereby allowing a system comprising of an information processing system and diagnostic system to be configured on the network. In this case, an information processing system and maintenance diagnostic system are connected is parallel to the LAN line, and this permits access to the information processing system from other than maintenance diagnostic system with the result that user security protection is insufficient. To solve this problem, Official Gazette of Japanese Patent Laid-Open NO. 149188/1997 discloses a remote maintenance diagnostic system, wherein a maintenance diagnostic system to supervise the operation status of the system connected to the information processing system has such an independent (autonomous) network functions as network access function and supervision analysis function, and connection of said information processing system to the network is made through said maintenance diagnostic system, thereby improving security protection and reducing the system installation cost.
With ever advancing and complicating technologies, it is getting increasingly difficult to manufacture all the large sized facilities such as the semiconductor manufacturing line in one company. In an increasing number of cases, they must be manufactured with the cooperation of multiple companies or must be partly purchased from manufacturers of the manufacturing system. Consequently, to ensure a quick and accurate diagnosis of such large sized facilities, the company is required to provide detailed information on the control, maintenance and management of the facilities, on the one hand.
On the other hand, providing such information to other companies may signify leakage of company security, and the disclosure thereof is accompanied by many restrictions. Let us assume, for example, that a client having purchased a semiconductor manufacturing system from a manufacturing system manufacturer and is required to submit information by the manufacturer for the diagnosis of the system. In this case, crucial information on the client semiconductor production status or manufacturing know-how may be known to other companies leak, depending on the type of information.
In recent years, however, production and management facilities have become centralized and are large-sized. When the semiconductor manufacturing line, for example, has become faulty to disturb production under these circumstances and there is a delay in diagnosing the causes for the fault, a great economic loss will be caused by production suspension.
The conventional remote diagnostic system has no elastic, highly reliable security function enough to meet such complicated requirements.
The object of the present invention is to provide a remote diagnostic system and diagnostic method having an elastic, highly reliable security function to ensure harmony between two requirements of protection of company security and prevention of increased economic loss in the remote diagnosis of facilities.
The present invention is characterized by a remote diagnostic system for facilities which carries out a diagnosis on the facilities placed under the management of the first company, using the diagnostic system of the second company which is connected to said facilities through a communications network and which is not placed under the management of said first company; wherein said facilities comprise a security level evaluation control means which changes the scope of reply in response to an inquiry from said diagnostic system regarding information on said facilities for diagnosis in conformance to the degree of the event related to said inquiry.
The present invention is characterized by a remote diagnostic system for facilities which carries out a diagnosis on the facilities placed under the management of the first company, using the diagnostic system of the second company which is connected to said facilities through a communications network and which is not placed under the management of said first company;
The present invention is characterized by a remote diagnostic system for facilities which carries out a diagnosis on the facilities placed under the management of the first company, using the diagnostic system of the second company which is connected to said facilities through a communications network and which is not placed under the management of said first company;
The present invention is characterized in that the right of access to said information is classified into at least three levels;
Another feature of the present invention is that said facilities are a semiconductor manufacturing system. The present invention provides a remote diagnostic system and diagnostic method to ensure harmony between two requirements of protection of company security and prevention of increased economic loss in the remote diagnosis of facilities.
The following describes the embodiments according to the present invention:
This diagnostic system carries out a diagnosis on the facilities placed under the management of the first company (company A) periodically or whenever diagnosis is required, using the diagnostic system of the second company (company B) which is connected to said facilities through a communications network and which is not placed under the management of said first company. In this embodiment, Company B is assumed as a manufacturer having produced and delivered part or the majority of the semiconductor manufacturing system of Company A. Company B can be a specialist service company to provide maintenance services of the semiconductor manufacturing system of Company A.
In this remote diagnostic system, the semiconductor manufacturing system 10(10A to 10N) of Company A for which failure is diagnosed and data are updated is connected to a semiconductor manufacturing system control server 20 comprising a control means to control all of these semiconductor manufacturing systems 10. The server 20 is connected to the Intranet 30 in Company A. It is further connected to the Internet 50 through the Internet server 40 and Firewall system 42. The Internet 50 is connected with a diagnostic system 70 comprising the diagnostic program of the semiconductor manufacturing system through Firewall system 62 of Company B and the Internet server 60 (and the Intranet).
The semiconductor manufacturing system control server 20 comprises (1) a storage unit which stores information classified into multiple security levels having different access rights in order to determine the scope of reply in response to an inquiry regarding information on the diagnosis of the semiconductor manufacturing system, and (2) a security level evaluation control means 27 to determine if a new access right should bed assigned or not in conformance to the degree of the event related to said inquiry, and to carry out processing based on the results thereof.
A general telephone line, leased communications line or communications line by fiber-optic cable is used for connection among the semiconductor manufacturing system, servers, the Internet and diagnostic system. It goes without saying that an IP address or specific ID number is assigned to each piece of equipment in advance for communications between Company A as a client and Company B as a system manufacturer.
Each of the semiconductor manufacturing system control servers 20 and 40 is composed of a computer, and is connected with a display and operation unit as an I/O means including a keyboard and mouse. Servers 20 and 40 are provided with browser software (WWW browser) to access the Internet 50 and server 60. Each of the semiconductor manufacturing systems 10 (10A to 10N) has a personal computer, and is connected with a display and operation unit as an I/O means including a keyboard and mouse.
The computer of each of the servers 20 and 40 is provided with an interface for connection with the external equipment. This interface is used for communications of data and command between the microcomputer in each computer and external equipment. It has a communications program and communications interface, and provides modulation and transmission of the data and command created by the microcomputer, and reception and demodulation of the data and commands sent through telephone line.
The semiconductor manufacturing system control server 20 is composed of a personal computer, for example, and is connected with a display and operation unit as an I/O means including a keyboard and mouse. It is also provided with an interface 22 for connection with the external equipment, and communications interface 23. A browser software (WWW browser) 25 for access to the Internet 50 through server 40 and connection with server 60 is held by the storage means of the microcomputer having a CPU.
Furthermore, it comprises a program 26 required for administration and control of the semiconductor manufacturing system 10 (10A to 10N) and for production management, database 28, security level evaluation control means 27 (security evaluation program 27A, data on common items for diagnosis, database 27B for information on maintenance, buffer memory 27C for temporary storage of information for which Company B has the right of access, general security information database 29, etc.
The security level evaluation control means 27 of the semiconductor manufacturing system control server 20 is determines the scope of providing the data on the semiconductor manufacturing system which is requested by Company B for periodic or temporary remote diagnosis, namely, access right.
The security level evaluation control means 27 is also equipped with a recipe 25 format change function to change a recipe in order to provide the required data to Company B with security protected. Such information for which Company B has a right to access is temporarily stored in the buffer memory 27 only during diagnosis. The diagnostic system of Company B is allowed to access the semiconductor manufacturing system control server 20 only for the information retained in the buffer memory 27C. Furthermore, the information which allows the buffer memory 27C to be accessed by the diagnostic system of Company B is retained, for example, by the security information database 29.
“Error log” in the table signifies the code giving time-series representation of information error having occurred in the system. “Operation log” denotes a record of the operation details of the semiconductor manufacturing system with time before the start of diagnosis. “Service sequence” means a program which routinely checks if a system, e.g., the semiconductor manufacturing system of Company A is normal or not. Generally, the client side of the system runs the program on a periodic basis to check the system status.
“Lot data” indicates the code which records the result of processing subsequent to processing of the semiconductor manufacturing system of Company A. Normally, it records the amount of monitor corresponding to a recipe item. For example, there is information to shows that the flow rate monitor indicates 101 ml/min. in contrast to the flow rate setting of 100 ml/min. “Recipe” is the record information describing the object conditions of the product.
Level A in the table shows that Company B has a right of access at all times on condition of security protection. In other words, information on level A is provided whenever requested by Company B. Levels B and C show that Company B has no access right in principle. If there is a request from the diagnostic system of Company B, whether access right is assigned on condition of security protection or not is determined according to the specific event. When the system is purchased from Company B or a support agreement is signed, these levels are determined as a basic data security level in the system, together with security protection matters, according to the relation between client Company A and Company B. They are then converted into data. The right of Company B to access the information of levels B and C is changed according to economic loss due to production failure resulting from failure, urgency and loss resulting from disclosure of information. In this manner, the security evaluation means 27 determines the access right of Company B, in other words, the scope of providing information according to the preset security level and specific event.
The diagnostic system 70 makes an inquiry about the information regarding the facilities of Company A where said information is assigned with access right in advance. Then it conducts diagnosis based on the obtained information. Furthermore, it requests said first company to provide additional information on the high order security level not assigned with access right, if additional information is required for said diagnosis, and performs diagnosis based on the additional information obtained by being assigned with a new access right.
Numerals 219-1 to 219-4 denote an operation information signal generation means to produce operation information signals showing that the operation of process treatment systems 202-1 to 202-4 is enabled or not. In the present embodiment, it is installed on the process treatment system, but can be installed at any place.
Numerals 220 and 221 denote a communications means, and serves to connect between the main controller 211 to provide the entire system and auxiliary operation panel 222. Auxiliary operation panels 222, 225 and 226 are used for above-mentioned applications. Numeral 224 is a terminal control means which stores the processing procedure to control the terminal functions of the auxiliary operation panel. Numeral 223 indicates a central control means to control above-mentioned 221 and 224 to 226, and is composed of a CPU, for example.
Using
In regular diagnosis, the client A sends the status data or regular diagnostic data to the system manufacturer B through the server and the Internet (302). The data is stored in the database for regular diagnosis of system manufacturer B (402). When an error has occurred, on the other hand, diagnosis request specified in the form of error event, error number, etc. is sent from client A to system manufacturer B via the Internet. The time of diagnosis can be can be notified from system manufacturer B to client A in advance.
If there is a request for regular or irregular diagnosis from client A, the diagnostic system 70 of the system manufacturer B starts the diagnostic program to initiate a remote diagnosis of the semiconductor manufacturing system 10 of the client A.
The diagnostic program requests the semiconductor manufacturing system control server 20 of client A (hereinafter referred to as “client A”) to get data on level A (404). Client A receives this request (306), and determines the scope of data (308) by making reference to the security level preset by the security evaluation means 24. Data on level A is sent to Company B on condition of security protection for the data.
Based on the data on level A, information for system diagnosis such as the error code of the system, maintenance information database and diagnostic database unique to the client, the diagnostic program starts diagnosis on the semiconductor manufacturing system 10 of client A, and analyzes the causes for failure (406). When the causes have been analyzed (408), causes are sent to the client A (410). Furthermore, the diagnostic program evaluates if the component must be replaced or not (412). If component replacement is not required, the system goes to the step of termination (440) to terminate diagnostic processing. Termination information is also sent to the client, and the system goes to the step of termination (314) to perform the processing required upon termination of diagnosis, for example, deletion of data of the buffer memory 27C.
If component replacement is required, an inquiry is sent to client A asking if the component can be replaced or not (414). If client A sends back a reply of approval, arrangement is made for component replacement. To put it specifically, notifies is given to the component replacement service companies C and D to replace the component. Then the system proceeds to the step of termination (440) to complete diagnostic processing.
Information on termination is also sent to the client, and the system goes to the step of termination (314).
When the cause for analysis cannot be found out, evaluation is made to see if more data required for analysis can be provided by client A (418). If it is assumed that no more data can be obtained, or it is not clear whether more data can be obtained or not, evaluation is made to determine whether or not test running is to be conducted (420). For example, there are cases where there is no prospect of getting more adequate information regarding a specific event after request has been made for submission of additional information on the high order security level not assigned with access right. It is difficult to make all these evaluations automatically. Actually, the operator of the diagnostic system evaluates the general situation and enters the result into the diagnostic system.
If it has been evaluated that test running should be performed, an inquiry is sent to the client A to show the evaluation (422). If a reply of approval is given by client A (318), a diagnostic program for specific diagnosis is sent to client A (424) to get the result (320). In addition to the information on this result, analysis processing is carried out again (406).
Even if the causes for failure cannot be found out by the above-mentioned analysis, analysis is made to find out what are the required data (434) if data required for analysis is provided by the client A. Then negotiation is made with the client A to get the required data (436). Let us assume that m pieces of additional data are necessary.
If there is a request to get this data, the information security evaluation means 27 of client A determines whether a new access right is assigned or not in response to preset security level and specific event. In other words, it determines the scope of data to be supplied to Company B (332).
As shown in
Above-mentioned loss coefficients Kd, Ke and Km show only one example. It is also possible to make evaluation by calculating coefficients using a combination of other parameters. To simplify calculation, it is possible to form a table by a combination of some parameters in advance. It is also possible for the operator to make evaluation of step 912. For example, referring to the information in the above-mentioned table, the operator makes a final evaluation as to the assignment of access right. The result of this evaluation is entered into the information security evaluation means 27.
Going back to
In addition to this added data, diagnosis is again started on the semiconductor manufacturing system 10 of the client A to analyze the failure (406). If the cause is analyzed (408), the cause is notified to client A (410). Similar processing is repeated thereafter.
As a result of running the test (420), the current result of analysis is reported to the client (428), and discussion is made on subsequent behavior (430). For example, discussion is made as to the necessity of dispatching a service person. If dispatching is necessary, request is sent to the service company to dispatch the service person (432). If causes have been found out by the service person (310), necessary steps are taken for termination (314). Processing is now complete. This step of termination includes the step of reporting to Company B that the causes have been found and necessary steps must be taken taken by the client A. The result of termination is notified to Company B as well, and the result is recorded in the database of the diagnostic system of Company B. The process of diagnosis is now complete (440). In the step of termination, diagnostic information and result gained from the client A are processed to ensure that security protection can be provided as requested by the client, or is deleted from the storage unit.
If causes are not clear, request for diagnosis is made again from the client A to Company B based on the additional data gained through checkup by the service person (316). In response to this request for diagnosis, diagnostic processing in step 404 and thereafter is started.
In this way, data collection, diagnosis and, if required, checkup by service person are carried out in conformance to the security level and specific event. Then even if failure has occurred to the system, quick analysis is made and adequate remedial action is taken in almost all cases. From the view point of the client A, leakage of security data is minimized in diagnosis and the result of quick analysis is obtained. This will result in minimized economic loss.
In this remote diagnostic system, the semiconductor manufacturing system 10 (10A to 10N) of Company A which is the object of faulty diagnosis and data updating is connected to the semiconductor manufacturing system control server 20 of Company A. Server 20 is connected to the Intranet 30 in the Company A, and is further connected to the Internet 50 through the Internet server 40 and Firewall system 42. The diagnostic system 70 loaded with the diagnostic program of the semiconductor manufacturing system is connected to the Internet 50 through the Firewall system 62 of Company B and the Internet server 60 (and the Intranet). The Internet 50 is connected to the server and database related to the components of the component manufacturers C, D and E of the semiconductor manufacturing system through the Firewall system and the Internet servers 80, 81 and 82 (and the Intranet).
The server related to components of the component manufacturers C, D and E comprises;
In this embodiment, steps 406 to 408 shown in
In the steps described above, Company B can make a remote diagnosis of the semiconductor manufacturing system of Company A periodically or whenever required, with the cooperation of system component manufacturers C, D and E, using the diagnostic program. In this case as well, data collection, diagnosis and, if required, checkup by service person are carried out in conformance to the security level and specific event. Then even if failure has occurred to the system, quick analysis can be made and adequate remedial action can be taken in almost all cases. From the view point of the client A and system component manufacturers C,D and E, leakage of security data is minimized in diagnosis and the result of quick analysis is obtained.
Since the related mode is not a normal operation mode, such software is usually not contained in the semiconductor manufacturing system proper. Only at the time of diagnosis, the software is downloaded from the server 20 in the semiconductor manufacturing system 10 of the client, and the test program is run. In this embodiment, an error is found in the trend of pressure reduction according to the result of running the test program, as illustrated. This leads to the conclusion that the failure is caused by pump deterioration. Thus, causes for failure have been found out quickly and accurately to terminate the analysis. This test program is not required in the normal operation mode, and is deleted automatically in the semiconductor manufacturing system 10 upon completion of diagnosis.
The above has described examples of the present invention being applied to the semiconductor manufacturing system. The scope of application of the present invention is not restricted to them alone. For example, it can be extensively applied to the diagnosis of facilities in cases where the companies different from the users of the production facilities in the chemical plant and automobile production line, and such facilities as found in the power generation plant and financial system are engaged in the production, and the users have their own trade secrets in the use of such facilities.
The present invention provides a remote diagnostic system and diagnostic method having an elastic, highly reliable security function to ensure harmony between two requirements of protection of company security and prevention of increased economic loss in the remote diagnosis of facilities.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2000-219695 | Jul 2000 | JP | national |
The present application is a continuation of application Ser. No. 09/790,691, filed Feb. 23, 2001, the contents of which are incorporated herein by reference.
| Number | Date | Country | |
|---|---|---|---|
| Parent | 09790691 | Feb 2001 | US |
| Child | 11003472 | Dec 2004 | US |
